GNOME Bugzilla – Bug 520745
CVE-2008-0072 format string vulnerability on Evolution multiple versions
Last modified: 2013-09-13 00:56:33 UTC
original ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/evolution/+bug/198742 From Secunia advisory: "Secunia Research has discovered a vulnerability in Evolution, which can be exploited by malicious people to compromise a vulnerable system. A format string error in the "emf_multipart_encrypted()" function in mail/em-format.c when displaying data (e.g. the "Version:" field) from an encrypted e-mail message can be exploited to execute arbitrary code via a specially crafted e-mail message. Successful exploitation requires that the user selects a malicious e-mail message. The vulnerability is confirmed in version 2.12.3. Other versions may also be affected." The Ubuntu bug reports Debian has already published a fix: http://www.debian.org/security/2008/dsa-1512
Created attachment 106680 [details] [review] Suggested patch to trunk
Created attachment 106681 [details] [review] Suggested patch to trunk
By accident, you posted the same thing twice. Tor your patch is absolultely awesome. It fixes the security issue. The core issue was that format specifier was missing and the string directly had the "%n" which accessed random locations to crash it on viewing the encrypted mail. We should ask for a freeze break and commit it to trunk. I'll do that.
two r-t approvals by olav and vuntz on the r-t mailing list. setting patch status to accepted-commit_now.
Committed as rev 35143.