Описание
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
Меры по смягчению последствий
To mitigate this issue, users can disable JavaScript execution for HTML mail in Evolution. This can be done through the Evolution preferences or by using gsettings. Disabling JavaScript may affect the rendering and functionality of some legitimate HTML emails.
To disable JavaScript via gsettings, execute the following command:
gsettings set org.gnome.evolution.mail enable-javascript false
To revert this change, execute:
gsettings set org.gnome.evolution.mail enable-javascript true
Note that changes to gsettings take effect immediately, but Evolution may need to be restarted for the setting to be fully applied to already open mail views.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | evolution | Out of support scope | ||
| Red Hat Enterprise Linux 7 | evolution | Fix deferred | ||
| Red Hat Enterprise Linux 8 | evolution | Fix deferred | ||
| Red Hat Enterprise Linux 9 | evolution | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
(A flaw was found in Evolution. A remote attacker can exploit this vuln ...)
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
A flaw was found in Evolution. A remote attacker can exploit this vuln ...
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.
EPSS
6.3 Medium
CVSS3