Oracle Linux 3 / 4 : evolution (ELSA-2008-0516)
High Nessus Plugin ID 67705
SynopsisThe remote Oracle Linux host is missing one or more security updates.
DescriptionFrom Red Hat Security Advisory 2008:0516 :
Updated evolution packages that address a buffer overflow vulnerability are now available for Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4.
This update has been rated as having critical security impact by the Red Hat Security Response Team.
Evolution is the integrated collection of e-mail, calendaring, contact management, communications and personal information management (PIM) tools for the GNOME desktop environment.
A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If mail which included a carefully crafted iCalendar attachment was opened, arbitrary code could be executed as the user running Evolution. (CVE-2008-1108)
Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.
All users of Evolution should upgrade to these updated packages, which contains a backported patch which resolves this issue.
SolutionUpdate the affected evolution packages.