Description
The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | evolution | 2.2.3-4 | — |
| Debian 13 | evolution | 2.2.3-4 | — |
| Debian 12 | evolution | 2.2.3-4 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- GNOME Evolution 2.2.3/2.3.x - Inline XML File Attachment Buffer Overflow EDB-27145 · dos · Jan 28, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 16408 vdb-entry
- USN-265-1 vendor-advisory
- SUSE-SR:2006:007 vendor-advisory
- 610 third-party-advisory
- MDKSA-2006:057 vendor-advisory
- 20060128 gnome evolution mail client inline text file DoS issue mailing-list
- 19504 third-party-advisory