{"id":"CVE-2018-12422","aliases":["DEBIAN-CVE-2018-12422","EUVD-2018-4395","GHSA-rqw6-r9qq-6v6g","UBUNTU-CVE-2018-12422"],"status":"disputed","title":"** DISPUTED ** addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME...","description":"addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because \"the code had computed the required string length first, and then allocated a large-enough buffer on the heap.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01766,"percentile":0.78235,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2018-06-15T16:00:00Z","modified":"2026-10-24T10:49:32Z","fixes":[{"ecosystem":"Debian:12","package":"evolution-data-server","fixed_in":["3.28.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"evolution-data-server","fixed_in":["3.28.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"evolution-data-server","fixed_in":["3.28.5-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.5-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.5-1ubuntu3","3.18.1-1ubuntu1","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-1ubuntu1","3.18.3-1ubuntu2","3.18.4-0ubuntu1","3.18.5-1ubuntu1","3.18.5-1ubuntu1.1","3.18.5-1ubuntu1.2","3.18.5-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.5-1ubuntu3","3.18.1-1ubuntu2","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-0ubuntu1","3.18.3-1ubuntu1","3.18.4-0ubuntu1","3.18.5-1ubuntu1","3.18.5.1-1ubuntu1","3.18.5.2-0ubuntu1","3.18.5.2-0ubuntu3","3.18.5.2-0ubuntu3.1","3.18.5.2-0ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-1ubuntu1","3.26.2-1ubuntu1","3.26.2.1-1ubuntu1","3.26.2.1-1ubuntu3","3.26.3-1ubuntu1","3.26.5-1ubuntu3","3.27.90-1ubuntu1","3.28.0-1ubuntu1","3.28.0-2ubuntu1","3.28.0-2ubuntu2","3.28.1-1ubuntu1","3.28.3-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.2","3.28.5-0ubuntu0.18.04.3","3.28.5-0ubuntu0.18.04.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-1","3.26.2-1","3.26.2-1ubuntu1","3.26.3-1","3.26.5-1","3.26.5-1build1","3.27.90-1","3.28.0-1","3.28.0-4","3.28.1-1","3.28.1-2","3.28.5-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.2"]}],"products":[{"vendor":"gnome","product":"evolution"}],"references":[{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=796174","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://gitlab.gnome.org/GNOME/evolution-data-server/commit/34bad6173","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12422"},{"url":"https://github.com/advisories/GHSA-rqw6-r9qq-6v6g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12422","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-12422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12422","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-12422","description":"addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because \"the code had computed the required string length first, and then allocated a large-enough buffer on the heap.","status":"disputed","published":"2018-06-15T16:00:00Z","modified":"2024-08-05T08:38:05.771Z","updated_at":"2026-11-02T14:35:06.679212Z"}],"euvd":[{"id":"EUVD-2018-4395","description":"addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because \"the code had computed the required string length first, and then allocated a large-enough buffer on the heap.","status":"published","published":"2018-06-15T16:00:00Z","modified":"2024-08-05T08:38:05Z","updated_at":"2026-11-03T02:39:52.61924Z"}],"ghsa":[{"id":"GHSA-rqw6-r9qq-6v6g","title":"** DISPUTED ** addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME...","description":"** DISPUTED ** addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because \"the code had computed the required string length first, and then allocated a large-enough buffer on the heap.\"","status":"published","published":"2022-05-14T03:09:04Z","modified":"2023-02-02T05:07:00Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:24.832262Z"}],"nvd":[{"id":"CVE-2018-12422","description":"addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because \"the code had computed the required string length first, and then allocated a large-enough buffer on the heap.","status":"disputed","published":"2018-06-15T16:29:00.437Z","modified":"2026-06-17T01:37:45.783Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"CVE-2018-12422","description":"addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because \"the code had computed the required string length first, and then allocated a large-enough buffer on the heap.","status":"published","published":"2018-06-15T16:29:00.437Z","modified":"2026-10-24T10:49:32.568922665Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12422","description":"addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because \"the code had computed the required string length first, and then allocated a large-enough buffer on the heap.","status":"published","published":"2018-06-15T16:29:00.437Z","modified":"2026-10-23T18:02:58.642853256Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-12422","description":"addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because \"the code had computed the required string length first, and then allocated a large-enough buffer on the heap.","status":"published","published":"2018-06-15T16:29:00Z","modified":"2026-06-01T15:45:10.589194579Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:17.014176Z"}]}}