CVE-2008-1108 Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.
HighCVSS 7.6
EPSS 5.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME evolution | = 2.2.1 | No fix listed |
| debian/evolution(Debian:12) | < 2.22.2-1.1 | 2.22.2-1.1 |
| debian/evolution(Debian:13) | < 2.22.2-1.1 | 2.22.2-1.1 |
| debian/evolution(Debian:14) | < 2.22.2-1.1 | 2.22.2-1.1 |
References
- SUSE-SA:2008:028 vendor-advisory
- 30298 third-party-advisory vendor-advisory
- 30527 third-party-advisory
- 30536 third-party-advisory
- 30564 third-party-advisory
- 30571 third-party-advisory
- 30702 third-party-advisory
- 30716 third-party-advisory
- secunia.com
- GLSA-200806-06 vendor-advisory
- MDVSA-2008:111 vendor-advisory
- RHSA-2008:0514 vendor-advisory
- RHSA-2008:0515 vendor-advisory
- RHSA-2008:0516 vendor-advisory
- RHSA-2008:0517 vendor-advisory
- 29527 vdb-entry
- 1020169 vdb-entry
- USN-615-1 vendor-advisory
- ADV-2008-1732 vdb-entry
- evolution-icalendar-bo(42824) vdb-entry
- oval:org.mitre.oval:def:10471 signature vdb-entry
- FEDORA-2008-4990 vendor-advisory
- FEDORA-2008-5016 vendor-advisory
- FEDORA-2008-5018 vendor-advisory
- Debian Security Tracker CVE-2008-1108 vendor-advisory
- bugs.debian.org issue-tracking