CVE-2011-3201

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via...

4.3 MediumFix available

CVE-2011-3201 is a medium vulnerability (CVSS 4.3) in Gnome Evolution, published March 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.67%, the 86th percentile. Fixed in evolution 0:2.28.3-30.el6.

What does this mean?

Severity: 4.3 MediumCVSS 2.0, NVD
Exploit chance: 2.67%EPSS, 86th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 0:2.28.3-30.el6evolution +26 more

Description

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

Exploit likelihood

2.67%Up 1.4 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`evolution` Debian:12	All versions, plus listed versions 3.46.4-23.46.4-2+deb12u13.47.2-13.47.3-13.48.0-1 Show 45 moreShow less 3.48.1-13.48.2-13.48.3-13.48.4-13.49.2-13.49.2-23.49.2-33.49.3-13.50.0-13.50.1-13.50.2-13.50.3-13.51.2-13.52.0-13.52.1-13.52.1-23.52.1-33.52.1-43.52.2-13.52.2-23.52.3-13.53.2-13.53.3-13.54.0-13.54.1-13.54.2-13.54.3-13.54.3-23.55.1-13.55.1-23.55.2-13.55.3-13.56.0-13.56.1-13.56.2-13.56.2-103.56.2-23.56.2-33.56.2-43.56.2-53.56.2-73.56.2-83.56.2-93.62.0-13.62.1-1	None known
`evolution` Debian:13	All versions, plus listed versions 3.56.1-13.56.1-1+deb13u13.56.2-0+deb13u13.56.2-13.56.2-10 Show 10 moreShow less 3.56.2-23.56.2-33.56.2-43.56.2-53.56.2-73.56.2-83.56.2-93.62.0-13.62.1-13.62.1-2	None known
`evolution` Debian:14	All versions, plus listed versions 3.56.1-13.56.2-13.56.2-103.56.2-23.56.2-3 Show 8 moreShow less 3.56.2-43.56.2-53.56.2-73.56.2-83.56.2-93.62.0-13.62.1-13.62.1-2	None known
`evolution` Red Hat:enterprise_linux:6::client	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-conduits` Red Hat:enterprise_linux:6::client	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-debuginfo` Red Hat:enterprise_linux:6::client	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-devel` Red Hat:enterprise_linux:6::client	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-perl` Red Hat:enterprise_linux:6::client	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-pst` Red Hat:enterprise_linux:6::client	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-spamassassin` Red Hat:enterprise_linux:6::client	before 0:2.28.3-30.el6	0:2.28.3-30.el6

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`evolution-help` Red Hat:enterprise_linux:6::client	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution` Red Hat:enterprise_linux:6::server	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-conduits` Red Hat:enterprise_linux:6::server	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-debuginfo` Red Hat:enterprise_linux:6::server	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-devel` Red Hat:enterprise_linux:6::server	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-help` Red Hat:enterprise_linux:6::server	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-perl` Red Hat:enterprise_linux:6::server	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-pst` Red Hat:enterprise_linux:6::server	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-spamassassin` Red Hat:enterprise_linux:6::server	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution` Red Hat:enterprise_linux:6::workstation	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-conduits` Red Hat:enterprise_linux:6::workstation	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-devel` Red Hat:enterprise_linux:6::workstation	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-perl` Red Hat:enterprise_linux:6::workstation	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-pst` Red Hat:enterprise_linux:6::workstation	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-spamassassin` Red Hat:enterprise_linux:6::workstation	before 0:2.28.3-30.el6	0:2.28.3-30.el6
`evolution-help` Red Hat:enterprise_linux:6::workstation	before 0:2.28.3-30.el6	0:2.28.3-30.el6

What each source reports

NVD Score used4.3

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

Record: CVE-2011-3201
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE ListNo score

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

Record: CVE-2011-3201
Updated: 2026-11-02

EUVDEUVD-2011-3165No score

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

Record: EUVD-2011-3165
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vj43-93vc-r5g8No score

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via...

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

Record: GHSA-vj43-93vc-r5g8
Weakness: CWE-200
Updated: 2026-11-02

OSVNo score

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

Record: CVE-2011-3201
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-3201No score

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

Record: DEBIAN-CVE-2011-3201
Updated: 2026-11-02