rpm package
opensuse/evolution-ews&distro=openSUSE Leap 15.2
pkg:rpm/opensuse/evolution-ews&distro=openSUSE%20Leap%2015.2
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-16117 | — | < 3.34.4-lp152.2.3.1 | 3.34.4-lp152.2.3.1 | Jul 29, 2020 | In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server. | ||
| CVE-2020-14928 | — | < 3.34.4-lp152.2.3.1 | 3.34.4-lp152.2.3.1 | Jul 17, 2020 | evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection." |
- CVE-2020-16117Jul 29, 2020affected < 3.34.4-lp152.2.3.1fixed 3.34.4-lp152.2.3.1
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.
- CVE-2020-14928Jul 17, 2020affected < 3.34.4-lp152.2.3.1fixed 3.34.4-lp152.2.3.1
evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."