Описание
Security update for evolution-data-server
This update for evolution-data-server fixes the following issues:
- Fix buffer overrun when parsing base64 data (bsc#1182882).
- CVE-2020-16117: Fix crash on malformed server response with minimal capabilities (bsc#1174712).
- CVE-2020-14928: Response injection via STARTTLS in SMTP and POP3 (bsc#1173910).
Список пакетов
SUSE Linux Enterprise Workstation Extension 12 SP5
libcamel-1_2-57-3.20.6-17.3.1
libedataserver-1_2-21-3.20.6-17.3.1
Ссылки
- Link for SUSE-SU-2021:0885-1
- E-Mail link for SUSE-SU-2021:0885-1
- SUSE Security Ratings
- SUSE Bug 1173910
- SUSE Bug 1174712
- SUSE Bug 1182882
- SUSE CVE CVE-2020-14928 page
- SUSE CVE CVE-2020-16117 page
Описание
evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."
Затронутые продукты
SUSE Linux Enterprise Workstation Extension 12 SP5:libcamel-1_2-57-3.20.6-17.3.1
SUSE Linux Enterprise Workstation Extension 12 SP5:libedataserver-1_2-21-3.20.6-17.3.1
Ссылки
- CVE-2020-14928
- SUSE Bug 1173910
Описание
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.
Затронутые продукты
SUSE Linux Enterprise Workstation Extension 12 SP5:libcamel-1_2-57-3.20.6-17.3.1
SUSE Linux Enterprise Workstation Extension 12 SP5:libedataserver-1_2-21-3.20.6-17.3.1
Ссылки
- CVE-2020-16117
- SUSE Bug 1174712