CVE-2003-0130 The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers to inject arbitrary data and H...
MediumCVSS 5.0
EPSS 10.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers to inject arbitrary data and HTML via a MIME Content-ID header in a MIME-encoded image.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ximian evolution | = 1.0.3 | No fix listed |
| ximian evolution | = 1.0.4 | No fix listed |
| ximian evolution | = 1.0.5 | No fix listed |
| ximian evolution | = 1.0.6 | No fix listed |
| ximian evolution | = 1.0.7 | No fix listed |
| ximian evolution | = 1.0.8 | No fix listed |
| ximian evolution | = 1.1.1 | No fix listed |
| ximian evolution | = 1.2 | No fix listed |
| ximian evolution | = 1.2.1 | No fix listed |
| ximian evolution | = 1.2.2 | No fix listed |
| debian/evolution(Debian:12) | < 1.2.3 | 1.2.3 |
| debian/evolution(Debian:13) | < 1.2.3 | 1.2.3 |
| debian/evolution(Debian:14) | < 1.2.3 | 1.2.3 |
References
- Debian Security Tracker CVE-2003-0130 vendor-advisory
- 20030319 CORE-2003-03-04-01: Multiple vulnerabilities in Ximian 's Evolution Mail User Agent mailing-list
- CLA-2003:648 vendor-advisory
- 20030321 GLSA: evolution (200303-18) mailing-list
- www.coresecurity.com patch vendor-advisory
- GLSA-200303-18 vendor-advisory
- MDKSA-2003:045 vendor-advisory
- RHSA-2003:108 vendor-advisory
- 7119 exploit patch vdb-entry vendor-advisory
- oval:org.mitre.oval:def:111 signature vdb-entry