remote code execution

Please Install the Updated Packages.

Multiple buffer overflows have been fixed in Evolution. CVE-2008-1108: A buffer overflow in Evolution, when the ITip Formatter plugin is disabled, allows remote attackers potentially to execute arbitrary code via a long timezone string in an iCalendar attachment. CVE-2008-1109: A heap-based buffer overflow in Evolution allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).

evolution on openSUSE 10.2, openSUSE 10.3, Novell Linux Desktop 9, SUSE Linux Enterprise Desktop 10 SP1, SLE SDK 10 SP1, SLE SDK 10 SP2, SUSE Linux Enterprise Desktop 10 SP2, SUSE Linux Enterprise 10 SP2 DEBUGINFO

• http://www.novell.com/linux/security/advisories/2008_28_evolution.html

---

Updated on 2015-03-25