huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2011-2525: kernel: kernel: net_sched: fix qdisc_notify()
Component: kernel
Severity: Moderate
Public date: 2010-05-21T00:00:00+00:00

The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted call.

Statement: This flaw affects Red Hat Enterprise Linux 4 and 5. It did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they have already backported the upstream commit 53b0f080 that addressed this flaw. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2011-1065.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.35
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 53b0f08042f04813cd1a7473dacd3edfacb28eb3
CVE-2011-2689: kernel: gfs2: make sure fallocate bytes is a multiple of blksize
Component: kernel
Severity: Moderate
Public date: 2011-04-26T00:00:00+00:00

The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and Red Hat Enterprise MRG as they did not provide support for the Global File System 2 (GFS2). This has been addressed in Red Hat Enterprise Linux 5 and 6 via https://rhn.redhat.com/errata/RHSA-2011-1065.html and https://rhn.redhat.com/errata/RHSA-2011-1189.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.0
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 6905d9e4dda6112f007e9090bca80507da158e63
CVE-2011-2692: libpng: Invalid read when handling empty sCAL chunks
Component: libpng
Severity: Moderate
Public date: 2011-07-07T00:00:00+00:00

The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.


Affected upstream versions: n/a
Upstream repository: https://libpng.git.sourceforge.net/git/libpng/libpng
Upstream fix commit: 61a2d8a2a7b03023e63eae9a3e64607aaaa6d339
CVE-2011-2695: kernel: ext4: kernel panic when writing data to the last block of sparse file
Component: kernel
Severity: Moderate
Public date: 2011-06-03T00:00:00+00:00

Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.

Statement: This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1386.html,  https://rhn.redhat.com/errata/RHSA-2011-1189.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not include support for EXT4 filesystem.

Affected upstream versions: n/a
Fixed upstream versions: v3.0
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: f17722f917b2f21497deb6edc62fb1683daa08e6
CVE-2011-2699: kernel: ipv6: make fragment identifications less predictable
Component: kernel
Severity: Important
Public date: 2011-07-20T00:00:00+00:00

The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service (disrupted networking) by predicting these values and sending crafted packets.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise MRG as it has backported the fix that addresses this issue. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates. This has been addressed in Red Hat Enterprise Linux 5 and 6 via https://rhn.redhat.com/errata/RHSA-2011-1386.html and https://rhn.redhat.com/errata/RHSA-2011-1465.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 87c48fa3b4630905f98268dde838ee43626a060c
CVE-2011-2723: kernel: gro: only reset frag0 when skb can be pulled
Component: kernel
Severity: Moderate
Public date: 2011-07-27T00:00:00+00:00

The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel before 2.6.39.4, when Generic Receive Offload (GRO) is enabled, resets certain fields in incorrect situations, which allows remote attackers to cause a denial of service (system crash) via crafted network traffic.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not backport the upstream commit a5b1cf28 that introduced this issue. This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1386.html, https://rhn.redhat.com/errata/RHSA-2011-1350.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.1
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 17dd759c67f21e34f2156abcf415e1f60605a188
CVE-2011-2724: cifs-utils: mount.cifs incorrect fix for CVE-2010-0547
Component: cifs-utils
Severity: Low
Public date: 2011-07-29T00:00:00+00:00

The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.


Affected upstream versions: n/a
Upstream repository: https://git.samba.org/cifs-utils.git
Upstream fix commit: 1e7a32924b22d1f786b6f490ce8590656f578f91
CVE-2011-2895: BSD compress LZW decoder buffer overflow
Component: BSD compress LZW decoder buffer overflow
Severity: Important
Public date: 2011-08-10T00:00:00+00:00

The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.


Affected upstream versions: n/a
Fixed upstream versions: libXfont-1.4.4
Upstream repository: https://cgit.freedesktop.org/xorg/lib/libXfont
Upstream fix commit: d11ee5886e9d9ec610051a206b135a4cdc1e09a0
CVE-2011-2896: David Koblas' GIF decoder LZW decoder buffer overflow
Component: David Koblas' GIF decoder LZW decoder buffer overflow
Severity: Moderate
Public date: 2011-08-10T00:00:00+00:00

The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

Statement: Vulnerable. This issue affects the versions of cups as shipped with Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this issue as having moderate security impact for the cups package. A future update may address this issue in the cups package for Red Hat Enterprise Linux 4, 5, and 6. For additional information, refer to the Issue Severity Classification:
https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: GIMP_2_7_3
Upstream repository: https://git.gnome.org/browse/gimp
Upstream fix commit: 376ad788c1a1c31d40f18494889c383f6909ebfc
CVE-2011-2898: kernel: af_packet: infoleak
Component: kernel
Severity: Low
Public date: 2011-06-07T00:00:00+00:00

net/packet/af_packet.c in the Linux kernel before 2.6.39.3 does not properly restrict user-space access to certain packet data structures associated with VLAN Tag Control Information, which allows local users to obtain potentially sensitive information via a crafted application.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as they did not backport the upstream commit 393e52e3 that introduced this flaw. This has been addressed in Red Hat Enterprise Linux 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1350.html and https://rhn.redhat.com/errata/RHSA-2012-0010.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.0
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 13fcb7bd322164c67926ffe272846d4860196dc6
CVE-2011-2905: kernel: perf tools: may parse user-controlled configuration file
Component: kernel
Severity: Low
Public date: 2011-08-07T00:00:00+00:00

Untrusted search path vulnerability in the perf_config function in tools/perf/util/config.c in perf, as distributed in the Linux kernel before 3.1, allows local users to overwrite arbitrary files via a crafted config file in the current working directory.

Statement: This issue did not affect Red Hat Enterprise Linux 4 and 5 as they did not include support for perf. This did not affect Red Hat Enterprise MRG as it uses the perf package from Red Hat Enterprise Linux 6. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-1465.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: aba8d056078e47350d85b06a9cabd5afcc4b72ea
CVE-2011-2911: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3
Component: libmodplug
Severity: Important
Public date: 2011-07-15T00:00:00+00:00

Integer overflow in the CSoundFile::ReadWav function in src/load_wav.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted WAV file, which triggers a heap-based buffer overflow.


Affected upstream versions: n/a
Upstream repository: https://modplug-xmms.git.sourceforge.net/git/modplug-xmms/modplug-xmms
Upstream fix commit: 2d4c56de314ab13e4437bd8b609f0b751066eee8
CVE-2011-2912: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3
Component: libmodplug
Severity: Important
Public date: 2011-07-15T00:00:00+00:00

Stack-based buffer overflow in the CSoundFile::ReadS3M function in src/load_s3m.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted S3M file with an invalid offset.


Affected upstream versions: n/a
Upstream repository: https://modplug-xmms.git.sourceforge.net/git/modplug-xmms/modplug-xmms
Upstream fix commit: f4e5295658fff000379caa122e75c9200205fe20
CVE-2011-2913: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3
Component: libmodplug
Severity: Important
Public date: 2011-07-15T00:00:00+00:00

Off-by-one error in the CSoundFile::ReadAMS function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (stack memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of samples.


Affected upstream versions: n/a
Upstream repository: https://modplug-xmms.git.sourceforge.net/git/modplug-xmms/modplug-xmms
Upstream fix commit: 26243ab9fe1171f70053e9aec4b20e9f7de9e4ef
CVE-2011-2914: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3
Component: libmodplug
Severity: Important
Public date: 2011-07-15T00:00:00+00:00

Off-by-one error in the CSoundFile::ReadDSM function in src/load_dms.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted DSM file with a large number of samples.


Affected upstream versions: n/a
Upstream repository: https://modplug-xmms.git.sourceforge.net/git/modplug-xmms/modplug-xmms
Upstream fix commit: 26243ab9fe1171f70053e9aec4b20e9f7de9e4ef
CVE-2011-2915: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3
Component: libmodplug
Severity: Important
Public date: 2011-07-15T00:00:00+00:00

Off-by-one error in the CSoundFile::ReadAMS2 function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of instruments.


Affected upstream versions: n/a
Upstream repository: https://modplug-xmms.git.sourceforge.net/git/modplug-xmms/modplug-xmms
Upstream fix commit: 16d7a78efe14d345a6c5b241f88422ad0ee483ea
CVE-2011-2918: kernel: perf: Fix software event overflow
Component: kernel
Severity: Moderate
Public date: 2011-07-22T00:00:00+00:00

The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which allows local users to cause a denial of service (system hang) via a crafted application.

Statement: This issue did not affect Red Hat Enterprise Linux 4 and 5 as they did not include support for perf. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1350.html and https://rhn.redhat.com/errata/RHSA-2012-0333.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.1
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: a8b0ca17b80e92faab46ee7179ba9e99ccb61233
CVE-2011-3045: libpng: buffer overflow in png_inflate caused by invalid type conversions
Component: libpng
Severity: Moderate
Public date: 2012-03-08T00:00:00+00:00

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.


Affected upstream versions: n/a
Upstream repository: https://libpng.git.sourceforge.net/git/libpng/libpng
Upstream fix commit: a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b
CVE-2011-3131: kernel: xen: IOMMU fault livelock
Component: kernel
Severity: Moderate
Public date: 2011-08-12T00:00:00+00:00

Xen 4.1.1 and earlier allows local guest OS kernels with control of a PCI[E] device to cause a denial of service (CPU consumption and host hang) via many crafted DMA requests that are denied by the IOMMU, which triggers a livelock.

Statement: The versions of the Linux kernel as shipped with Red Hat Enterprise Linux 4, 6,
and Red Hat Enterprise MRG are not affected. It has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2011-1386.html.

Affected upstream versions: n/a
Upstream repository: https://xenbits.xen.org/hg/staging/xen-4.1-testing.hg
Upstream fix commit: 84e3706df07a
CVE-2011-3146: librsvg: object type mismatch leading to invalid pointer dereference
Component: librsvg
Severity: Moderate
Public date: 2011-09-06T00:00:00+00:00

librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which is misidentified as a RsvgFilterPrimitive.


Affected upstream versions: n/a
Fixed upstream versions: 2.34.1
Upstream repository: https://git.gnome.org/browse/librsvg
Upstream fix commit: 34c95743ca692ea0e44778e41a7c0a129363de84
CVE-2011-3148: (pam_env): Stack-based buffer overflow by parsing user's pam_environment file
Component: (pam_env)
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
Public date: 2011-10-24T00:00:00+00:00

Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.

Statement: This issue did not affect the versions of pam package as shipped with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Upstream repository: https://git.fedorahosted.org/git/linux-pam.git
Upstream fix commit: caf5e7f61c8d9288daa49b4f61962e6b1239121d
CVE-2011-3149: (pam_env): Infinite loop by expanding certain arguments
Component: (pam_env)
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2011-10-24T00:00:00+00:00

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).

Statement: This issue did not affect the versions of pam package as shipped with Red Hat Enterprise Linux 4 and 5.

Affected upstream versions: n/a
Upstream repository: https://git.fedorahosted.org/git/linux-pam.git
Upstream fix commit: 109823cb621c900c07c4b6cdc99070d354d19444
CVE-2011-3188: kernel: net: improve sequence number generation
Component: kernel
Severity: Moderate
Public date: 2011-08-07T00:00:00+00:00

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.

Statement: This issue affects the Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, 6, and Red Hat Enterprise MRG. It has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1386.html, https://rhn.redhat.com/errata/RHSA-2011-1465.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v3.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: bc0b96b54a21246e377122d54569eef71cec535f
CVE-2011-3191: kernel: cifs: signedness issue in CIFSFindNext()
Component: kernel
Severity: Important
Public date: 2011-08-23T00:00:00+00:00

Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.

Statement: This issue affects the Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, 6, and Red Hat Enterprise MRG. It has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1386.html, https://rhn.redhat.com/errata/RHSA-2011-1465.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v3.1
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9438fabb73eb48055b58b89fc51e0bc4db22fabd
CVE-2011-3193: qt/harfbuzz buffer overflow
Component: qt/harfbuzz buffer overflow
Severity: Moderate
Public date: 2011-07-19T00:00:00+00:00

Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.


Affected upstream versions: n/a
Fixed upstream versions: 1.25.1
Upstream repository: https://git.gnome.org/browse/pango/commit/pango/opentype/harfbuzz-gpos.c
Upstream fix commit: a7a715480db66148b1f487528887508a7991dcd0
CVE-2011-3194: qt buffer overflow in greyscale images
Component: qt buffer overflow in greyscale images
Severity: Moderate
Public date: 2010-09-18T00:00:00+00:00

Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.


Affected upstream versions: n/a
Upstream repository: https://qt.gitorious.org/qt/qt
Upstream fix commit: cb6380beb81ab9571c547270c144988781fed465
CVE-2011-3200: rsyslog: parseLegacySyslogMsg off-by-two buffer overflow
Component: rsyslog
Severity: Moderate
Public date: 2011-09-01T00:00:00+00:00

Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message.


Affected upstream versions: n/a
Upstream repository: https://git.adiscon.com/rsyslog.git
Upstream fix commit: 1ca6cc236d1dabf1633238b873fb1c057e52f95e
CVE-2011-3201: evolution: mailto URL scheme attachment header improper input validation
Component: evolution
Severity: Low
CWE: CWE-356 (Product UI does not Warn User of Unsafe Actions)
Public date: 2011-08-25T00:00:00+00:00

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.


Affected upstream versions: n/a
Fixed upstream versions: EVOLUTION_3_2_3
Upstream repository: https://git.gnome.org/browse/evolution
Upstream fix commit: 0a478083fa31aec0059bc6feacc054226fe55b56