CVE-2020-11879 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-11879 Interim 1 35 2023-09-21T23:59:16Z current 2021-05-30T14:39:34Z 2023-09-21T23:59:16Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-11879 An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2023-August/015988.html E-Mail link for SUSE-SU-2023:3375-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 evolution evolution-3.22.6-19.14.1 evolution-devel evolution-devel-3.22.6-19.14.1 evolution-lang evolution-lang-3.22.6-19.14.1 evolution-plugin-bogofilter evolution-plugin-pst-import evolution-plugin-spamassassin evolution-plugin-text-highlight glade-catalog-evolution evolution-devel-3.22.6-19.14.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 evolution-3.22.6-19.14.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 evolution-lang-3.22.6-19.14.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 evolution as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 evolution-devel as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 evolution-lang as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 evolution-plugin-bogofilter as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 evolution-plugin-pst-import as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 evolution-plugin-spamassassin as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 evolution-plugin-text-highlight as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 glade-catalog-evolution as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 evolution as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 evolution-devel as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 evolution-lang as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 evolution-plugin-bogofilter as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 evolution-plugin-pst-import as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 evolution-plugin-spamassassin as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 evolution-plugin-text-highlight as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 glade-catalog-evolution as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 evolution as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 evolution-devel as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 evolution-lang as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 evolution-plugin-bogofilter as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 evolution-plugin-pst-import as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 evolution-plugin-spamassassin as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 evolution-plugin-text-highlight as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 evolution as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 evolution-devel as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 evolution-lang as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 evolution-plugin-bogofilter as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 evolution-plugin-pst-import as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 evolution-plugin-spamassassin as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 evolution-plugin-text-highlight as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value. CVE-2020-11879 SUSE Linux Enterprise Software Development Kit 12 SP5:evolution-devel-3.22.6-19.14.1 SUSE Linux Enterprise Workstation Extension 12 SP5:evolution-3.22.6-19.14.1 SUSE Linux Enterprise Workstation Extension 12 SP5:evolution-lang-3.22.6-19.14.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:evolution SUSE Linux Enterprise Module for Package Hub 15 SP4:evolution-devel SUSE Linux Enterprise Module for Package Hub 15 SP4:evolution-lang SUSE Linux Enterprise Module for Package Hub 15 SP4:evolution-plugin-bogofilter SUSE Linux Enterprise Module for Package Hub 15 SP4:evolution-plugin-pst-import SUSE Linux Enterprise Module for Package Hub 15 SP4:evolution-plugin-spamassassin SUSE Linux Enterprise Module for Package Hub 15 SP4:evolution-plugin-text-highlight SUSE Linux Enterprise Module for Package Hub 15 SP4:glade-catalog-evolution SUSE Linux Enterprise Module for Package Hub 15 SP5:evolution SUSE Linux Enterprise Module for Package Hub 15 SP5:evolution-devel SUSE Linux Enterprise Module for Package Hub 15 SP5:evolution-lang SUSE Linux Enterprise Module for Package Hub 15 SP5:evolution-plugin-bogofilter SUSE Linux Enterprise Module for Package Hub 15 SP5:evolution-plugin-pst-import SUSE Linux Enterprise Module for Package Hub 15 SP5:evolution-plugin-spamassassin SUSE Linux Enterprise Module for Package Hub 15 SP5:evolution-plugin-text-highlight SUSE Linux Enterprise Module for Package Hub 15 SP5:glade-catalog-evolution SUSE Linux Enterprise Workstation Extension 15 SP4:evolution SUSE Linux Enterprise Workstation Extension 15 SP4:evolution-devel SUSE Linux Enterprise Workstation Extension 15 SP4:evolution-lang SUSE Linux Enterprise Workstation Extension 15 SP4:evolution-plugin-bogofilter SUSE Linux Enterprise Workstation Extension 15 SP4:evolution-plugin-pst-import SUSE Linux Enterprise Workstation Extension 15 SP4:evolution-plugin-spamassassin SUSE Linux Enterprise Workstation Extension 15 SP4:evolution-plugin-text-highlight SUSE Linux Enterprise Workstation Extension 15 SP5:evolution SUSE Linux Enterprise Workstation Extension 15 SP5:evolution-devel SUSE Linux Enterprise Workstation Extension 15 SP5:evolution-lang SUSE Linux Enterprise Workstation Extension 15 SP5:evolution-plugin-bogofilter SUSE Linux Enterprise Workstation Extension 15 SP5:evolution-plugin-pst-import SUSE Linux Enterprise Workstation Extension 15 SP5:evolution-plugin-spamassassin SUSE Linux Enterprise Workstation Extension 15 SP5:evolution-plugin-text-highlight moderate 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N