Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-11879: Evolution can attach local files without user warning

CVE-2020-11879 · published 6 years ago

Summary

If you use Evolution version earlier than 3.35.91, a specially crafted mailto link on a web page can cause the program to add files or folders from your computer to an email without showing any alert. This could unintentionally share private data. Update Evolution to the latest version or apply the vendor's security update to stop this behavior.

What to do

Update debian evolution to version 3.36.0-1.
Update gnome evolution to version 3.35.91 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	evolution	< 3.36.0-1 Fix: upgrade to 3.36.0-1
Debian:13	debian	evolution	< 3.36.0-1 Fix: upgrade to 3.36.0-1
Debian:14	debian	evolution	< 3.36.0-1 Fix: upgrade to 3.36.0-1
–	gnome	evolution	< 3.35.91 `cpe:2.3:a:gnome:evolution::::::::`

Original advisory text

An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.

References

https://security-tracker.debian.org/tracker/CVE-2020-11879 Vendor Advisory
https://gitlab.gnome.org/GNOME/evolution/-/blob/master/NEWS Third Party Advisory
https://gitlab.gnome.org/GNOME/evolution/issues/784 Third Party Advisory
https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/08/15/mail... Third Party Advisory

Severity

6.5 Medium

Exploitation

3% chance of attack within 30 days

Timeline

Published17 Apr 2020

Updated30 Oct 2026

First seen11 Sep 2026

Sources

DEBIAN-CVE-2020-11879 · OSV

CVE-2020-11879 · NVD

Track software like this

Free during beta