Ximian Evolution < 1.2.3 MIME image/* Content-Type Data Injection

Medium Nessus Network Monitor Plugin ID 1308


The remote host may be tricked into running an executable file


The remote host is running a version of the Ximian Evolution email client that does not properly validate MIME image/* Content-Type fields. If an email message contains an image/* Content-Type, any type of data can be embedded where the image information is expected. This can be used to embed HTML tags that will be rendered by GTKHtml, bypass policies, or invoke bonobo components to handle external content types.


Upgrade to Evolution 1.2.3 or higher.

Plugin Details

Severity: Medium

ID: 1308

Family: SMTP Clients

Published: 2004/08/20

Modified: 2016/11/23

Dependencies: 1100

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:C


Base Score: 5.3

Temporal Score: 4.9


Temporal Vector: CVSS3#E:F/RL:O/RC:C

Reference Information

CVE: CVE-2003-0130

BID: 7119