Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:0776-1

Опубликовано: 03 мар. 2026
Источник: suse-cvrf

Описание

Security update for evolution-data-server

This update for evolution-data-server fixes the following issue:

  • CVE-2026-2604: arbitrary file deletion via inconsistent URI handling (bsc#1258307).

Список пакетов

SUSE Linux Enterprise Module for Package Hub 15 SP7
libebackend-1_2-10-3.42.5-150400.3.10.1
libebook-1_2-20-3.42.5-150400.3.10.1
libebook-contacts-1_2-3-3.42.5-150400.3.10.1
libecal-2_0-1-3.42.5-150400.3.10.1
libedata-book-1_2-26-3.42.5-150400.3.10.1
libedata-cal-2_0-1-3.42.5-150400.3.10.1
SUSE Linux Enterprise Workstation Extension 15 SP7
libcamel-1_2-63-3.42.5-150400.3.10.1
libebackend-1_2-10-3.42.5-150400.3.10.1
libebook-1_2-20-3.42.5-150400.3.10.1
libebook-contacts-1_2-3-3.42.5-150400.3.10.1
libedata-book-1_2-26-3.42.5-150400.3.10.1
libedataserver-1_2-26-3.42.5-150400.3.10.1

Ссылки

Описание

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:libebackend-1_2-10-3.42.5-150400.3.10.1
SUSE Linux Enterprise Module for Package Hub 15 SP7:libebook-1_2-20-3.42.5-150400.3.10.1
SUSE Linux Enterprise Module for Package Hub 15 SP7:libebook-contacts-1_2-3-3.42.5-150400.3.10.1
SUSE Linux Enterprise Module for Package Hub 15 SP7:libecal-2_0-1-3.42.5-150400.3.10.1
Ссылки