Description
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | evolution-data-server | 2.22.3-1 | — |
| Debian 13 | evolution-data-server | 2.22.3-1 | — |
| Debian 12 | evolution-data-server | 2.22.3-1 | — |
| Debian 5.0 | evolution-data-server | 2.22.3-1.1+lenny1 | DSA-1813-1 |
| Debian 4.0 | evolution-data-server | 1.6.3-5etch2 | DSA-1813-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | evolution-data-server +2 | 1.12.3-10.el5_3.3 | RHSA-2009:0354 |
| RHEL 4 | evolution +1 | 2.0.2-41.el4_7.2 | RHSA-2009:0355 |
| RHEL 4 | evolution-data-server +1 | 1.0.2-14.el4_7.1 | RHSA-2009:0355 |
| RHEL 4 | evolution28-evolution-data-server +1 | 1.8.0-37.el4_7.2 | RHSA-2009:0354 |
| RHEL 3 | evolution +1 | 1.4.5-25.el3 | RHSA-2009:0358 |
Advisories 4
- RHSA-2009:0354 Red Hat Security Advisory: evolution-data-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0358 Red Hat Security Advisory: evolution security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0355 Red Hat Security Advisory: evolution and evolution-data-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1813-1 evolution-data-server - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 35357 third-party-advisory
- 52703 vdb-entry
- USN-733-1 vendor-advisory
- oval:org.mitre.oval:def:11385 vdb-entry signature
- 34339 third-party-advisory
- RHSA-2009:0358 vendor-advisory
- 34348 third-party-advisory
- [oss-security] 20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows mailing-list
- 34100 vdb-entry
- 34351 third-party-advisory
- RHSA-2009:0355 vendor-advisory
- 20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows mailing-list
- DSA-1813 vendor-advisory
- SUSE-SR:2010:012 vendor-advisory
- 52702 vdb-entry
- RHSA-2009:0354 vendor-advisory
- 34338 third-party-advisory
- MDVSA-2009:078 vendor-advisory
- http://ocert.org/patches/2008-015/camel-CVE-2009-0587.diff
- http://ocert.org/patches/2008-015/evc-CVE-2009-0587.diff
- http://www.ocert.org/advisories/ocert-2008-015.html