Skip to content
OpenAdvisories
Medium ALAS2-2026-3179 1 CVE

Moderate: evolution-data-server security update (Amazon Linux 2)

Published Mar 2, 2026 · Updated Mar 5, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-2604: The Evolution backend server exposes the D-Bus service org.gnome.evolution.dataserver.AddressBook, that can be used in order to manage contacts. A Flatpak application with access to this D-Bus service can exploit this issue in order to gain arbitrary file deletion on the host filesystem.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 evolution-data-server 0:3.28.5-4.amzn2.0.2
Amazon Linux · 2 evolution-data-server-debuginfo 0:3.28.5-4.amzn2.0.2
Amazon Linux · 2 evolution-data-server-devel 0:3.28.5-4.amzn2.0.2
Amazon Linux · 2 evolution-data-server-doc 0:3.28.5-4.amzn2.0.2
Amazon Linux · 2 evolution-data-server-langpacks 0:3.28.5-4.amzn2.0.2
Amazon Linux · 2 evolution-data-server-perl 0:3.28.5-4.amzn2.0.2
Amazon Linux · 2 evolution-data-server-tests 0:3.28.5-4.amzn2.0.2

Vulnerabilities 1

  • Medium 5.6
    CVE-2026-2604

    Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

    A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper valida…

    Red Hat GNOME Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-2604.html