CVE-2018-15587 GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as...
MediumCVSS 6.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/evolution(Debian:12) | < 3.30.5-1.1 | 3.30.5-1.1 |
| debian/evolution(Debian:13) | < 3.30.5-1.1 | 3.30.5-1.1 |
| debian/evolution(Debian:14) | < 3.30.5-1.1 | 3.30.5-1.1 |
| GNOME evolution | <= 3.28.2 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-15587 vendor-advisory
- openSUSE-SU-2019:1431 vendor-advisory
- openSUSE-SU-2019:1453 vendor-advisory
- openSUSE-SU-2019:1528 vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- 20190430 OpenPGP and S/MIME signature forgery attacks in multiple email clients mailing-list third-party-advisory
- [oss-security] 20190430 Spoofing OpenPGP and S/MIME Signatures in Emails (multiple clients) mailing-list third-party-advisory
- bugzilla.gnome.org exploit issue-tracking vendor-advisory
- github.com
- github.com
- [debian-lts-announce] 20190426 [SECURITY] [DLA 1766-1] evolution security update mailing-list third-party-advisory
- 20190609 [SECURITY] [DSA 4457-1] evolution security update mailing-list
- USN-3998-1 vendor-advisory
- DSA-4457 vendor-advisory
- bugs.debian.org issue-tracking