Remote File Access Vulnerability in Evolution Package
Summary
DEBIAN-CVE-2011-3201: GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email. Affects evolution versions 3.38.3-1 – 3.56.2-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Evolution is a personal information management application that integrates mail, calendar, address book, and task list functionalities. It is widely used in the GNOME desktop environment and is designed to provide a seamless experience for managing personal and professional information. However, prior to version 3.2.3, Evolution is susceptible to a vulnerability that allows remote attackers to exploit user-assisted actions to access arbitrary files on the user's system.
Vulnerability Detail
The vulnerability identified as CVE-2011-3201 allows user-assisted remote attackers to read arbitrary files through the attachment parameter in a mailto: URL. This occurs when a user clicks on a specially crafted mailto link that includes an attachment parameter pointing to a file on their local system. The flaw arises from insufficient validation of the attachment parameter, leading to potential exposure of sensitive information. Attackers can leverage this vulnerability to gain unauthorized access to files, which could include personal data, configuration files, or other sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid clicking on mailto links that contain attachment parameters from untrusted sources. Additionally, users can disable the handling of mailto links in their web browsers or email clients until the package is updated.
Conclusion
CVE-2011-3201 is a significant vulnerability affecting the Evolution package, allowing unauthorized access to files through user-assisted actions. Users are strongly encouraged to update their software to the latest version to protect against this risk. Additionally, employing Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for evolution →
FAQ
CVE-2011-3201 is a vulnerability in the Evolution package that allows remote attackers to read arbitrary files on a user's system through malicious mailto links.
If you are using a version of Evolution prior to 3.2.3, your installation is vulnerable to CVE-2011-3201.
If an immediate update is not possible, avoid clicking on suspicious mailto links and consider disabling mailto link handling in your applications.
Detailed information about CVE-2011-3201 can be found in the Debian security advisories and vulnerability databases.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using a manifest file like package-lock.json, allowing developers to stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for evolution.
