Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:0891-1

Опубликовано: 19 мар. 2021
Источник: suse-cvrf

Описание

Security update for evolution-data-server

This update for evolution-data-server fixes the following issues:

  • Fix buffer overrun when parsing base64 data (bsc#1182882).
  • CVE-2020-16117: Fix crash on malformed server response with minimal capabilities (bsc#1174712).
  • CVE-2020-14928: Response injection via STARTTLS in SMTP and POP3 (bsc#1173910).

Список пакетов

SUSE Linux Enterprise Software Development Kit 12 SP5
evolution-data-server-devel-3.22.7-18.7.1
typelib-1_0-EBook-1_2-3.22.7-18.7.1
typelib-1_0-EBookContacts-1_2-3.22.7-18.7.1
typelib-1_0-EDataServer-1_2-3.22.7-18.7.1
SUSE Linux Enterprise Workstation Extension 12 SP5
evolution-data-server-3.22.7-18.7.1
evolution-data-server-32bit-3.22.7-18.7.1
evolution-data-server-lang-3.22.7-18.7.1
libcamel-1_2-59-3.22.7-18.7.1
libcamel-1_2-59-32bit-3.22.7-18.7.1
libebackend-1_2-10-3.22.7-18.7.1
libebackend-1_2-10-32bit-3.22.7-18.7.1
libebook-1_2-16-3.22.7-18.7.1
libebook-1_2-16-32bit-3.22.7-18.7.1
libebook-contacts-1_2-2-3.22.7-18.7.1
libebook-contacts-1_2-2-32bit-3.22.7-18.7.1
libecal-1_2-19-3.22.7-18.7.1
libecal-1_2-19-32bit-3.22.7-18.7.1
libedata-book-1_2-25-3.22.7-18.7.1
libedata-book-1_2-25-32bit-3.22.7-18.7.1
libedata-cal-1_2-28-3.22.7-18.7.1
libedata-cal-1_2-28-32bit-3.22.7-18.7.1
libedataserver-1_2-22-3.22.7-18.7.1
libedataserver-1_2-22-32bit-3.22.7-18.7.1
libedataserverui-1_2-1-3.22.7-18.7.1

Ссылки

Описание

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

Затронутые продукты
SUSE Linux Enterprise Software Development Kit 12 SP5:evolution-data-server-devel-3.22.7-18.7.1
SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-EBook-1_2-3.22.7-18.7.1
SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-EBookContacts-1_2-3.22.7-18.7.1
SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-EDataServer-1_2-3.22.7-18.7.1
Ссылки

Описание

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.

Затронутые продукты
SUSE Linux Enterprise Software Development Kit 12 SP5:evolution-data-server-devel-3.22.7-18.7.1
SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-EBook-1_2-3.22.7-18.7.1
SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-EBookContacts-1_2-3.22.7-18.7.1
SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-EDataServer-1_2-3.22.7-18.7.1
Ссылки
Уязвимость SUSE-SU-2021:0891-1