bugtraq - [ MDVSA-2008:063 ] - Updated Evolution packages fix critical vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 06 Mar 2008 19:42:37 -0700
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2008:063 ] - Updated Evolution packages fix critical
 vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:063
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : evolution
 Date    : March 6, 2008
 Affected: 2007.1, 2008.0
 _______________________________________________________________________
 
 Problem Description:
 
 Ulf Harnhammar of Secunia Research discovered a format string flaw
 in how Evolution displayed encrypted mail content.  If a user were
 to open a carefully crafted email message, arbitrary code could be
 executed with the permissions of the user running Evolution.
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0072
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.1:
 4e8e24994ce1f37d7fa2b40b93cb7767  2007.1/i586/evolution-2.10.2-2.2mdv2007.1.i586.rpm
 7d2a80c1c7f506f064d2e05895b67b0d  2007.1/i586/evolution-devel-2.10.2-2.2mdv2007.1.i586.rpm
 0a80f0dd31179d99747c4c851e2ed8a9  2007.1/i586/evolution-mono-2.10.2-2.2mdv2007.1.i586.rpm
 4bd7556907014b0e047c30ce43484caf  2007.1/i586/evolution-pilot-2.10.2-2.2mdv2007.1.i586.rpm 
 826717f3fea97f934eb6a596f67edd96  2007.1/SRPMS/evolution-2.10.2-2.2mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 0951f21569c57a2c3975c5df7f5f2074  2007.1/x86_64/evolution-2.10.2-2.2mdv2007.1.x86_64.rpm
 8b0cef17cde0851a5fe626881b71c09a  2007.1/x86_64/evolution-devel-2.10.2-2.2mdv2007.1.x86_64.rpm
 43a889af38f11b34dc503f51de9f4921  2007.1/x86_64/evolution-mono-2.10.2-2.2mdv2007.1.x86_64.rpm
 7586926d4809c66fc8bbd656be2a64fc  2007.1/x86_64/evolution-pilot-2.10.2-2.2mdv2007.1.x86_64.rpm 
 826717f3fea97f934eb6a596f67edd96  2007.1/SRPMS/evolution-2.10.2-2.2mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 848621169e649c76a118adc78bbeb437  2008.0/i586/evolution-2.12.3-1.2mdv2008.0.i586.rpm
 0034c11598d908c5a94cb637b255a2c9  2008.0/i586/evolution-devel-2.12.3-1.2mdv2008.0.i586.rpm
 526f6dff8ed0501d4d685caa7dbd0a11  2008.0/i586/evolution-mono-2.12.3-1.2mdv2008.0.i586.rpm
 ae736c07e20a46a99b03c81a7047b440  2008.0/i586/evolution-pilot-2.12.3-1.2mdv2008.0.i586.rpm 
 bf7431bd51a057d8ef5a80d541ad8de1  2008.0/SRPMS/evolution-2.12.3-1.2mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 d3c4fd1d66dc8dec3a318cab203fc393  2008.0/x86_64/evolution-2.12.3-1.2mdv2008.0.x86_64.rpm
 5130831a0fd1c5d6a07f12fc8c5f68ff  2008.0/x86_64/evolution-devel-2.12.3-1.2mdv2008.0.x86_64.rpm
 96c34cd8fe5f4981e788f72e4038812a  2008.0/x86_64/evolution-mono-2.12.3-1.2mdv2008.0.x86_64.rpm
 126ff5b8d697970652cfa365926556df  2008.0/x86_64/evolution-pilot-2.12.3-1.2mdv2008.0.x86_64.rpm 
 bf7431bd51a057d8ef5a80d541ad8de1  2008.0/SRPMS/evolution-2.12.3-1.2mdv2008.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFH0IDwmqjQ0CJFipgRAmtrAKCGVdhPZQGuGThz2nx5+nPDwLQVHwCfXkVE
Qh479nJKUgUhwrrDha/xGKA=
=GDLZ
-----END PGP SIGNATURE-----