CVE-2009-1631

Description

The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.

Affected products

• GNOME / Evolution2.26.1
• GNOME / Evolution1.0.8 – 1.0.8
• GNOME / Evolution1.2 – 1.2
• GNOME / Evolution1.2.1 – 1.2.1
• GNOME / Evolution1.2.2 – 1.2.2
• GNOME / Evolution1.2.3 – 1.2.3
• GNOME / Evolution1.2.4 – 1.2.4
• GNOME / Evolution1.4 – 1.4
• GNOME / Evolution1.4.3 – 1.4.3
• GNOME / Evolution1.4.4 – 1.4.4
• GNOME / Evolution1.4.5 – 1.4.5
• GNOME / Evolution1.4.6 – 1.4.6
• GNOME / Evolution2.0.0 – 2.0.0
• GNOME / Evolution2.0.1 – 2.0.1
• GNOME / Evolution2.0.2 – 2.0.2
• GNOME / Evolution2.4 – 2.4
• GNOME / Evolution2.6 – 2.6
• GNOME / Evolution2.12 – 2.12
• GNOME / Evolution2.24 – 2.24

References

• VENDOR_ADVISORYhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409
• MISChttps://bugzilla.redhat.com/show_bug.cgi?id=498648
• MISChttp://bugzilla.gnome.org/show_bug.cgi?id=581604
• MISChttp://www.securityfocus.com/bid/34921
• MAILING_LISThttp://www.openwall.com/lists/oss-security/2009/05/12/6