[ MDVSA-2009:078 ] evolution-data-server

[dude67]

_______________________________________________________________________

Package : evolution-data-server
Date : March 23, 2009
Affected: 2008.0, 2008.1, 2009.0
_______________________________________________________________________

Problem Description:

A wrong handling of signed Secure/Multipurpose Internet Mail Extensions
(S/MIME) e-mail messages enables attackers to spoof its signatures
by modifying the latter copy (CVE-2009-0547).

Crafted authentication challange packets (NT Lan Manager type 2) sent
by a malicious remote mail server enables remote attackers either
to cause denial of service and to read information from the process
memory of the client (CVE-2009-0582).

Multiple integer overflows in Base64 encoding functions enables
attackers either to cause denial of service and to execute arbitrary
code (CVE-2009-0587).

This update provides fixes for those vulnerabilities.

Update:

evolution-data-server packages from Mandriva Linux distributions
2008.1 and 2009.0 are not affected by CVE-2009-0587.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0547
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0582
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0587
_______________________________________________________________________