Critical Integer Overflow Vulnerability in Evolution Package
Summary
CVE-2005-0102: Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users or remote malicious POP3 servers to execute arbitrary code via a length value of -1, which leads to a zero byte memory allocation an... Affects evolution versions < 2.0.3-1.2. Fixed in 2.0.3-1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Evolution is a personal information management application that integrates mail, calendar, address book, and task list functionalities. It is widely used in various Linux distributions, including Debian. The application is designed to provide users with a comprehensive suite for managing their personal and professional information. However, versions 2.0.2 and earlier are susceptible to a critical integer overflow vulnerability that can be exploited by malicious actors.
Vulnerability Detail
The vulnerability, identified as CVE-2005-0102, originates from an integer overflow in the camel-lock-helper component of Evolution. This flaw allows local users or remote malicious POP3 servers to execute arbitrary code. Specifically, a length value of -1 leads to a zero-byte memory allocation, resulting in a buffer overflow. This can have severe ramifications, including unauthorized access to system resources and potential system compromise.
How To Fix
Minimum fixed version
2.0.3-1.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade evolutionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the use of the POP3 protocol in Evolution until the package is updated. This can be done by navigating to the account settings and removing or disabling any POP3 accounts.
Conclusion
The integer overflow vulnerability in the Evolution package poses a significant risk to users, allowing for potential arbitrary code execution. It is crucial for users to upgrade to the fixed version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for evolution →
FAQ
CVE-2005-0102 is a critical vulnerability in the Evolution package that allows for arbitrary code execution due to an integer overflow.
Versions 2.0.2 and earlier of the Evolution package are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2005-0102 is 9.8, indicating a critical level of severity.
If an immediate upgrade is not possible, consider disabling POP3 accounts in Evolution as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for evolution.
