This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-11879 →

DEBIAN-CVE-2020-11879

An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other s...

Original description

The description as published by the source.

An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 evolution

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1"}]}]

Debian:13 evolution

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1"}]}]

Debian:14 evolution

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1"}]}]

References

advisory security-tracker.debian.org