Description
Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | evolution | 2.2.3-3 | — |
| Debian 13 | evolution | 2.2.3-3 | — |
| Debian 12 | evolution | 2.2.3-3 | — |
| Debian 4.0 | evolution | 2.2.3-2etch1 | DTSA-13-1 |
| Debian 3.1 | evolution | 2.0.4-2sarge1 | DSA-1016-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | evolution | 1.0.5-1woody3 | DSA-1016-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | evolution +1 | 2.0.2-16.3 | RHSA-2005:267 |
| RHEL 3 | evolution +1 | 1.4.5-16 | RHSA-2005:267 |
Advisories 3
- RHSA-2005:267 Red Hat Security Advisory: Evolution security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-13-1 evolution - format string vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1016-1 evolution - format string vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SA:2005:054 vendor-advisory
- 14532 vdb-entry
- RHSA-2005:267 vendor-advisory
- 19380 third-party-advisory
- DSA-1016 vendor-advisory
- FEDORA-2005-743 vendor-advisory
- MDKSA-2005:141 vendor-advisory
- 16394 third-party-advisory
- oval:org.mitre.oval:def:9553 vdb-entry signature
- http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html
- 20050810 Evolution multiple remote format string bugs mailing-list
- 20050810 Evolution multiple remote format string bugs mailing-list
- USN-166-1 vendor-advisory