Secunia

Secunia Research has discovered a vulnerability in Evolution, which can be exploited by malicious people to compromise a vulnerable system.

A format string error in the "emf_multipart_encrypted()" and "emf_inlinepgp_encrypted()" functions in mail/em-format.c when displaying data (e.g. the "Version:" field) from an encrypted e-mail message can be exploited to execute arbitrary code via a specially crafted e-mail message.

Successful exploitation requires that the user selects a malicious e-mail message.

The vulnerability is confirmed in version 2.12.3. Other versions may also be affected.

Solution
Update to version 2.22.0.

Provided and/or discovered by
Ulf Harnhammar, Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2008-8/

Other references
Further details available in Customer Area

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area