CVE Feed

    Dashboard / CVE / CVE-2008-0072

    CVE-2008-0072

    Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.

    Published:Mar 5, 2008
    Last Modified:Apr 23, 2026
    EPS:Mar 6, 2008
    EPSS Score:0.16096
    CVSS Score:6.8

    Affected Products

    Vendor
    Gnome
    Product
    Evolution
    Vendor
    Linux
    Product
    Linux Kernel
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Eus

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-135 Format String Injection
    CAPEC-67 String Format Overflow in syslog()

    Related CVEs

    CVE-2021-3349 (CVSS 3.3) — GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously …
    CVE-2020-11879 (CVSS 6.5) — An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?atta…
    CVE-2018-15587 (CVSS 6.5) — GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a spe…
    CVE-2018-12422 (CVSS 9.8) — addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 mig…
    CVE-2017-17689 (CVSS 5.9) — The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly l…
    CVE-2016-10727 (CVSS 9.8) — camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2…
    CVE-2013-4166 (CVSS 7.5) — The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolu…
    CVE-2011-3201 (CVSS 4.3) — GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment …
    CVE-2009-3721 (CVSS 7.8) — Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's …
    CVE-2009-2404 (CVSS 9.3) — Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.…

    References

    http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00003.html
    http://secunia.com/advisories/29057
    http://secunia.com/advisories/29163
    http://secunia.com/advisories/29210
    http://secunia.com/advisories/29244
    http://secunia.com/advisories/29258
    http://secunia.com/advisories/29264
    http://secunia.com/advisories/29317
    http://secunia.com/advisories/30437
    http://secunia.com/advisories/30491
    http://secunia.com/secunia_research/2008-8/advisory/
    http://security.gentoo.org/glsa/glsa-200803-12.xml
    http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0105
    http://www.debian.org/security/2008/dsa-1512
    http://www.kb.cert.org/vuls/id/512491
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:063
    http://www.redhat.com/support/errata/RHSA-2008-0177.html
    http://www.redhat.com/support/errata/RHSA-2008-0178.html
    http://www.securityfocus.com/archive/1/492684/100/0/threaded
    http://www.securityfocus.com/bid/28102
    http://www.securitytracker.com/id?1019540
    http://www.ubuntu.com/usn/usn-583-1
    http://www.vupen.com/english/advisories/2008/0768/references
    https://exchange.xforce.ibmcloud.com/vulnerabilities/41011
    https://issues.rpath.com/browse/RPL-2310
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10701
    https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00190.html
    https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00195.html
    http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00003.html
    http://secunia.com/advisories/29057
    http://secunia.com/advisories/29163
    http://secunia.com/advisories/29210
    http://secunia.com/advisories/29244
    http://secunia.com/advisories/29258
    http://secunia.com/advisories/29264
    http://secunia.com/advisories/29317
    http://secunia.com/advisories/30437
    http://secunia.com/advisories/30491
    http://secunia.com/secunia_research/2008-8/advisory/
    http://security.gentoo.org/glsa/glsa-200803-12.xml
    http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0105
    http://www.debian.org/security/2008/dsa-1512
    http://www.kb.cert.org/vuls/id/512491
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:063
    http://www.redhat.com/support/errata/RHSA-2008-0177.html
    http://www.redhat.com/support/errata/RHSA-2008-0178.html
    http://www.securityfocus.com/archive/1/492684/100/0/threaded
    http://www.securityfocus.com/bid/28102
    http://www.securitytracker.com/id?1019540
    http://www.ubuntu.com/usn/usn-583-1
    http://www.vupen.com/english/advisories/2008/0768/references
    https://exchange.xforce.ibmcloud.com/vulnerabilities/41011
    https://issues.rpath.com/browse/RPL-2310
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10701
    https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00190.html
    https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00195.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High