Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11879: An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | evolution | 0:3.28.5-10.amzn2.0.3 |
| Amazon Linux · 2 | evolution-bogofilter | 0:3.28.5-10.amzn2.0.3 |
| Amazon Linux · 2 | evolution-debuginfo | 0:3.28.5-10.amzn2.0.3 |
| Amazon Linux · 2 | evolution-devel | 0:3.28.5-10.amzn2.0.3 |
| Amazon Linux · 2 | evolution-devel-docs | 0:3.28.5-10.amzn2.0.3 |
| Amazon Linux · 2 | evolution-help | 0:3.28.5-10.amzn2.0.3 |
| Amazon Linux · 2 | evolution-langpacks | 0:3.28.5-10.amzn2.0.3 |
| Amazon Linux · 2 | evolution-pst | 0:3.28.5-10.amzn2.0.3 |
| Amazon Linux · 2 | evolution-spamassassin | 0:3.28.5-10.amzn2.0.3 |
Vulnerabilities 1
-
Unscored —
An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." p…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-11879.html