oss-security - Re: CVE Request (evolution)

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 21 May 2009 20:27:26 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: CVE Request (evolution)

======================================================
Name: CVE-2009-1631
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1631
Reference: MLIST:[oss-security] 20090512 CVE Request (evolution)
Reference: URL:http://www.openwall.com/lists/oss-security/2009/05/12/6
Reference: MISC:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409
Reference: MISC:http://bugzilla.gnome.org/show_bug.cgi?id=581604
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=498648

The Mailer component in Evolution 2.26.1 and earlier uses
world-readable permissions for the .evolution directory, and certain
directories and files under .evolution/ related to local mail, which
allows local users to obtain sensitive information by reading these
files.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.