Description
Evolution 2.22.3.1 checks S/MIME signatures against a copy of the e-mail text within a signed-data blob, not the copy of the e-mail text displayed to the user, which allows remote attackers to spoof a signature by modifying the latter copy, a different vulnerability than CVE-2008-5077.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | evolution-data-server | 2.24.5-2 | — |
| Debian 13 | evolution-data-server | 2.24.5-2 | — |
| Debian 12 | evolution-data-server | 2.24.5-2 | — |
| Debian 5.0 | evolution-data-server | 2.22.3-1.1+lenny1 | DSA-1813-1 |
| Debian 4.0 | evolution-data-server | 1.6.3-5etch2 | DSA-1813-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | evolution-data-server +2 | 1.12.3-10.el5_3.3 | RHSA-2009:0354 |
| RHEL 4 | evolution +1 | 2.0.2-41.el4_7.2 | RHSA-2009:0355 |
| RHEL 4 | evolution-data-server +1 | 1.0.2-14.el4_7.1 | RHSA-2009:0355 |
| RHEL 4 | evolution28-evolution-data-server +1 | 1.8.0-37.el4_7.2 | RHSA-2009:0354 |
Advisories 3
- RHSA-2009:0354 Red Hat Security Advisory: evolution-data-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0355 Red Hat Security Advisory: evolution and evolution-data-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1813-1 evolution-data-server - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 35357 third-party-advisory
- 33720 vdb-entry
- ADV-2010-1107 vdb-entry
- FEDORA-2009-2792 vendor-advisory
- SUSE-SR:2010:011 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=484925
- 34339 third-party-advisory
- [oss-security] 20090210 CVE Request -- evolution mailing-list
- 34363 third-party-advisory
- RHSA-2009:0355 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508479
- SUSE-SR:2010:006 vendor-advisory
- http://bugzilla.gnome.org/show_bug.cgi?id=564465
- DSA-1813 vendor-advisory
- SUSE-SR:2010:012 vendor-advisory
- RHSA-2009:0354 vendor-advisory
- oval:org.mitre.oval:def:9619 vdb-entry signature
- 34338 third-party-advisory
- FEDORA-2009-2784 vendor-advisory
- MDVSA-2009:078 vendor-advisory
- 38915 third-party-advisory
- 33848 third-party-advisory