CVE-2020-16117 — Vulnetix

Try Vulnetix Request Demo

CVE-2020-16117 PUBLISHED

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.

EPSS 0.51% · 66.1th percentile

Risk Scores

EPSS Score

0.51%

66.1th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:16.04:LTS	evolution-data-server	0, 3.16.5-1ubuntu3, 3.18.2-0ubuntu1
Ubuntu:18.04:LTS	evolution-data-server	0, 3.26.2-1ubuntu1, 3.26.1-1ubuntu1

Timeline

Jul 29, 2020 CVE Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Aug 23, 2021 EPSS Score
Dec 25, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 25, 2022 EPSS Score
Apr 28, 2022 EPSS Score
Jun 29, 2022 EPSS Score
Aug 31, 2022 EPSS Score
Nov 1, 2022 EPSS Score

References

https://ubuntu.com/security/CVE-2020-16117 third-party-advisory
https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/2cc39592b532cf0dc994fd3694b8e6bf924c9ab5 third-party-advisory
https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/627c3cdbfd077e59aa288c85ff8272950577f1d7 third-party-advisory
https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/189 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2020-16117 third-party-advisory

Open in Interactive Console →