Spoofing attack in Evolution - CVE-2018-15587
Published: February 14, 2019
Vulnerability identifier: #VU17667
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2018-15587
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Gnome Development Team
Affected software:
Evolution
Evolution
Detailed vulnerability description
The vulnerability allows a remote attacker to conduct spoofing attack.
The vulnerability exists due to improper validation of OpenPGP signatures. A remote attacker can trick the victim into opening a malicious email with valid PGP-signed data as an attachment and either inject arbitrary script code, which could be used to trick the user into disclosing sensitive information, or conduct further attacks.
How to mitigate CVE-2018-15587
Update to versions 3.28.3 or later.