Ubuntu Security Notice 1922-1 - Yves-Alexis Perez discovered that Evolution Data Server did not properly select GPG recipients. Under certain circumstances, this could result in Evolution encrypting email to an unintended recipient.
673fd931b78efc87aa81d57563e1b586b037596bd37d50b95a2c502ff906fdd3
============================================================================
Ubuntu Security Notice USN-1922-1
July 31, 2013
evolution-data-server vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
Summary:
Evolution would sometimes encrypt email to the wrong recipient.
Software Description:
- evolution-data-server: Evolution suite data server
Details:
Yves-Alexis Perez discovered that Evolution Data Server did not properly
select GPG recipients. Under certain circumstances, this could result in
Evolution encrypting email to an unintended recipient.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.04:
libcamel-1.2-40 3.6.4-0ubuntu1.1
Ubuntu 12.10:
libcamel-1.2-40 3.6.2-0ubuntu0.2
Ubuntu 12.04 LTS:
libcamel-1.2-29 3.2.3-0ubuntu7.1
After a standard system update you need to restart Evolution to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1922-1
CVE-2013-4166
Package Information:
https://launchpad.net/ubuntu/+source/evolution-data-server/3.6.4-0ubuntu1.1
https://launchpad.net/ubuntu/+source/evolution-data-server/3.6.2-0ubuntu0.2
https://launchpad.net/ubuntu/+source/evolution-data-server/3.2.3-0ubuntu7.1