CVE-2020-16117

Description

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.

Weakness classification

• nvd@nist.gov: CWE-476

Primary references

• cve@mitre.org — Patch, Vendor Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Exploit, Vendor Advisory
• cve@mitre.org — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory