| |||||||||||||||||||
Fedora alert FEDORA-2009-2792 (evolution-data-server)
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-2792 2009-03-18 18:32:42 -------------------------------------------------------------------------------- Name : evolution-data-server Product : Fedora 9 Version : 2.22.3 Release : 3.fc9 URL : http://www.gnome.org/projects/evolution/ Summary : Backend data server for Evolution Description : The evolution-data-server package provides a unified backend for programs that work with contacts, tasks, and calendar information. It was originally developed for Evolution (hence the name), but is now used by other packages. -------------------------------------------------------------------------------- Update Information: This update fixes two security issues: Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547) It was discovered that Evolution Data Server did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause an application using Evolution Data Server to disclose portions of its memory or crash during user authentication. (CVE-2009-0582) -------------------------------------------------------------------------------- ChangeLog: * Tue Mar 17 2009 Matthew Barnes <mbarnes@redhat.com> - 2.22.3-3.fc9 - Add patch for RH bug #484925 (CVE-2009-0547, S/MIME signatures). - Add patch for RH bug #487685 (CVE-2009-0582, NTLM authentication). * Tue Jul 8 2008 Matthew Barnes <mbarnes@redhat.com> - 2.22.3-2.fc9 - Add patch for GNOME bug #537415 (infinite loop in GAL authentication). * Mon Jun 30 2008 Matthew Barnes <mbarnes@redhat.com> - 2.22.3-1.fc9 - Update to 2.22.3 * Thu Jun 19 2008 Matthew Barnes <mbarnes@redhat.com> - 2.22.2-2.fc9 - Rebuild against libldap.a w/ NTLM support in openldap-2.4.8-5.fc9 to pick up fix in RH bug #450017. * Mon May 26 2008 Matthew Barnes <mbarnes@redhat.com> - 2.22.2-1.fc9 - Update to 2.22.2 - Remove patch for GNOME bug #531439 (fixed upstream). * Sun May 18 2008 Matthew Barnes <mbarnes@redhat.com> - 2.22.1.1-2.fc9 - Add patch for GNOME bug #531439 (GPG passphrases destroys passwords). * Fri May 2 2008 Matthew Barnes <mbarnes@redhat.com> - 2.22.1.1-1.fc9 - Update to 2.22.1.1 - Remove patch for GNOME bug #530323 (fixed upstream). -------------------------------------------------------------------------------- References: [ 1 ] Bug #484925 - CVE-2009-0547 evolution-data-server: S/MIME signatures are considered to be valid even for modified messages (MITM) https://bugzilla.redhat.com/show_bug.cgi?id=484925 [ 2 ] Bug #487685 - CVE-2009-0582 evolution-data-server: insufficient checking of NTLM authentication challenge packets https://bugzilla.redhat.com/show_bug.cgi?id=487685 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update evolution-data-server' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-ann... (Log in to post comments)
|
|||||||||||||||||||