Upstreamリリース3.28.4に更新してください

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

According to the versions of the evolution-data-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - evolution-data-server (eds) through 3.36.3 has a     STARTTLS buffering issue that affects SMTP and POP3.
    When a server sends a 'begin TLS' response, eds reads     additional data and evaluates it in a TLS context, aka     'response injection.'(CVE-2020-14928)

  - addressbook/backends/ldap/e-book-backend-ldap.c in     Evolution-Data-Server in GNOME Evolution through 3.29.2     might allow attackers to trigger a Buffer Overflow via     a long query that is processed by the strcat function.
    NOTE: the software maintainer disputes this because     'the code had computed the required string length     first, and then allocated a large-enough buffer on the     heap.'(CVE-2018-12422)

  - In GNOME evolution-data-server before 3.35.91, a     malicious server can crash the mail client with a NULL     pointer dereference by sending an invalid (e.g.,     minimal) CAPABILITY line on a connection attempt. This     is related to imapx_free_capability and     imapx_connect_to_server.(CVE-2020-16117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 3.28.4 upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 3.29.2 までの GNOME Evolution の Evolution-Data-Server の addressbook/backends/ldap/e-book-backend-ldap.c により、攻撃者が、strcat 関数によって処理される長いクエリを介して、バッファオーバーフローを発生させる可能性があります。注：ソフトウェアのメンテナーはこれに異議を唱えています。これは、コードが最初に必要な文字列の長さを計算し、次に十分な大きさのバッファをヒープに割り当てているためです。 （CVE-2018-12422）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 GNOME Evolution 及之前的 3.29.2 中，Evolution-Data-Server 中的 addressbook/backends/ldap/e-book-backend-ldap.c 可能允许攻击者通过由 strcat 函数处理的长查询触发缓冲区溢出。注意：软件维护人员对此表示异想，因为代码首先计算了所需的字符串长度，然后在堆上分配了足够大的缓冲区。 (CVE-2018-12422)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 至 3.29.2 版的 GNOME Evolution 中，Evolution-Data-Server 的 addressbook/backends/ldap/e-book-backend-ldap.c 可能允許攻擊者透過 strcat 函式處理的長查詢，觸發緩衝區溢位。注意：軟體維護者對此有爭議，因為程式碼已先計算所需的字串長度，然後在堆積上配置足夠大的緩衝區。 (CVE-2018-12422)

請注意，Nessus 依賴供應商報告的套件存在。

According to the version of the evolution-data-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - addressbook/backends/ldap/e-book-backend-ldap.c in     Evolution-Data-Server in GNOME Evolution through 3.29.2     might allow attackers to trigger a Buffer Overflow via     a long query that is processed by the strcat function.
    NOTE: the software maintainer disputes this because     'the code had computed the required string length     first, and then allocated a large-enough buffer on the     heap.'(CVE-2018-12422)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the evolution-data-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - addressbook/backends/ldap/e-book-backend-ldap.c in     Evolution-Data-Server in GNOME Evolution through 3.29.2     might allow attackers to trigger a Buffer Overflow via     a long query that is processed by the strcat function.
    NOTE: the software maintainer disputes this because     'the code had computed the required string length     first, and then allocated a large-enough buffer on the     heap.'(CVE-2018-12422)

  - In GNOME evolution-data-server before 3.35.91, a     malicious server can crash the mail client with a NULL     pointer dereference by sending an invalid (e.g.,     minimal) CAPABILITY line on a connection attempt. This     is related to imapx_free_capability and     imapx_connect_to_server.(CVE-2020-16117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2     might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat     function. NOTE: the software maintainer disputes this because the code had computed the required string     length first, and then allocated a large-enough buffer on the heap. (CVE-2018-12422)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
120247	Fedora 28：evolution / evolution-data-server / evolution-ews（2018-1434efb8f3）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/9	critical
146687	EulerOS 2.0 SP2 : evolution-data-server (EulerOS-SA-2021-1293)	Nessus	Huawei Local Security Checks	2021/2/22	2024/1/19	critical
120247	Fedora 28 : evolution / evolution-data-server / evolution-ews (2018-1434efb8f3)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/9	critical
222171	Linux Distros のパッチ未適用の脆弱性: CVE-2018-12422	Nessus	Misc.	2025/3/4	2025/8/21	critical
222171	Linux Distros 未修补的漏洞: CVE-2018-12422	Nessus	Misc.	2025/3/4	2025/8/21	critical
222171	Linux Distros 未修補弱點：CVE-2018-12422	Nessus	Misc.	2025/3/4	2025/8/21	critical
144238	EulerOS 2.0 SP5 : evolution-data-server (EulerOS-SA-2020-2544)	Nessus	Huawei Local Security Checks	2020/12/15	2024/2/1	critical
145184	EulerOS 2.0 SP3 : evolution-data-server (EulerOS-SA-2021-1065)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/29	critical
222171	Linux Distros Unpatched Vulnerability : CVE-2018-12422	Nessus	Misc.	2025/3/4	2025/8/21	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

critical