Description
Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | evolution | 2.2.3-3 | — |
| Debian 13 | evolution | 2.2.3-3 | — |
| Debian 12 | evolution | 2.2.3-3 | — |
| Debian 4.0 | evolution | 2.2.3-2etch1 | DTSA-13-1 |
| Debian 3.1 | evolution | 2.0.4-2sarge1 | DSA-1016-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | evolution | 1.0.5-1woody3 | DSA-1016-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | evolution +1 | 2.0.2-16.3 | RHSA-2005:267 |
| RHEL 3 | evolution +1 | 1.4.5-16 | RHSA-2005:267 |
Advisories 3
- RHSA-2005:267 Red Hat Security Advisory: Evolution security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-13-1 evolution - format string vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1016-1 evolution - format string vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SA:2005:054 vendor-advisory
- 14532 vdb-entry
- RHSA-2005:267 vendor-advisory
- 19380 third-party-advisory
- DSA-1016 vendor-advisory
- FEDORA-2005-743 vendor-advisory
- MDKSA-2005:141 vendor-advisory
- 16394 third-party-advisory
- oval:org.mitre.oval:def:10880 vdb-entry signature
- http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html
- 20050810 Evolution multiple remote format string bugs mailing-list
- 20050810 Evolution multiple remote format string bugs mailing-list
- USN-166-1 vendor-advisory