Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:0949-1

Опубликовано: 24 мар. 2021
Источник: suse-cvrf

Описание

Security update for evolution-data-server

This update for evolution-data-server fixes the following issues:

  • CVE-2020-16117: Fix crash on malformed server response with minimal capabilities (bsc#1174712).
  • CVE-2020-14928: Response injection via STARTTLS in SMTP and POP3 (bsc#1173910).
  • Fix buffer overrun when parsing base64 data (bsc#1182882).

This update for evolution-ews fixes the following issue:

  • Fix buffer overrun when parsing base64 data (bsc#1182882).

Список пакетов

SUSE Linux Enterprise Workstation Extension 15 SP2
evolution-data-server-3.34.4-3.3.1
evolution-data-server-devel-3.34.4-3.3.1
evolution-data-server-lang-3.34.4-3.3.1
evolution-ews-3.34.4-3.3.1
evolution-ews-lang-3.34.4-3.3.1
libcamel-1_2-62-3.34.4-3.3.1
libebackend-1_2-10-3.34.4-3.3.1
libebook-1_2-20-3.34.4-3.3.1
libebook-contacts-1_2-3-3.34.4-3.3.1
libecal-2_0-1-3.34.4-3.3.1
libedata-book-1_2-26-3.34.4-3.3.1
libedata-cal-2_0-1-3.34.4-3.3.1
libedataserver-1_2-24-3.34.4-3.3.1
libedataserverui-1_2-2-3.34.4-3.3.1
typelib-1_0-Camel-1_2-3.34.4-3.3.1
typelib-1_0-EBook-1_2-3.34.4-3.3.1
typelib-1_0-EBookContacts-1_2-3.34.4-3.3.1
typelib-1_0-ECal-2_0-3.34.4-3.3.1
typelib-1_0-EDataServer-1_2-3.34.4-3.3.1
typelib-1_0-EDataServerUI-1_2-3.34.4-3.3.1

Ссылки

Описание

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

Затронутые продукты
SUSE Linux Enterprise Workstation Extension 15 SP2:evolution-data-server-3.34.4-3.3.1
SUSE Linux Enterprise Workstation Extension 15 SP2:evolution-data-server-devel-3.34.4-3.3.1
SUSE Linux Enterprise Workstation Extension 15 SP2:evolution-data-server-lang-3.34.4-3.3.1
SUSE Linux Enterprise Workstation Extension 15 SP2:evolution-ews-3.34.4-3.3.1
Ссылки

Описание

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.

Затронутые продукты
SUSE Linux Enterprise Workstation Extension 15 SP2:evolution-data-server-3.34.4-3.3.1
SUSE Linux Enterprise Workstation Extension 15 SP2:evolution-data-server-devel-3.34.4-3.3.1
SUSE Linux Enterprise Workstation Extension 15 SP2:evolution-data-server-lang-3.34.4-3.3.1
SUSE Linux Enterprise Workstation Extension 15 SP2:evolution-ews-3.34.4-3.3.1
Ссылки