{"id":"CVE-2020-11879","aliases":["DEBIAN-CVE-2020-11879","EUVD-2020-4219","GHSA-c29m-85fj-ccfm","SUSE-SU-2023:3375-1","UBUNTU-CVE-2020-11879"],"status":"published","title":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068)...","description":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02761,"percentile":0.86388,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-04-17T17:07:41Z","modified":"2026-10-26T12:02:25Z","fixes":[{"ecosystem":"Debian:12","package":"evolution","fixed_in":["3.36.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"evolution","fixed_in":["3.36.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"evolution","fixed_in":["3.36.0-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"evolution","fixed_in":["3.22.6-19.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"evolution","fixed_in":["3.22.6-19.14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.6-19.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.6-19.14.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.5-1ubuntu3","3.18.1-1ubuntu2","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-0ubuntu1","3.18.3-1ubuntu1","3.18.4-0ubuntu1","3.18.5-1ubuntu1","3.18.5.1-1ubuntu1","3.18.5.2-0ubuntu1","3.18.5.2-0ubuntu3","3.18.5.2-0ubuntu3.1","3.18.5.2-0ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-1","3.26.2-1","3.26.2-1ubuntu1","3.26.3-1","3.26.5-1","3.26.5-1build1","3.27.90-1","3.28.0-1","3.28.0-4","3.28.1-1","3.28.1-2","3.28.5-0ubuntu0.18.04.1","3.28.5-0ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.1-2","3.34.1-2build1","3.34.1-3","3.34.1-4","3.35.91-1","3.35.92-1","3.36.0-1","3.36.1-1","3.36.1-2","3.36.2-0ubuntu1","3.36.3-0ubuntu1","3.36.4-0ubuntu1","3.36.5-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.40.4-1","3.42.0-2","3.42.1-1","3.42.2-1","3.42.3-1","3.43.3-1","3.44.0-1","3.44.0-1ubuntu1","3.44.1-0ubuntu1","3.44.4-0ubuntu1","3.44.4-0ubuntu2","3.44.4-0ubuntu2.1"]}],"products":[{"vendor":"gnome","product":"evolution"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/evolution/issues/784","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/evolution/-/blob/master/NEWS","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11879"},{"url":"https://github.com/advisories/GHSA-c29m-85fj-ccfm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-11879","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233375-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1169843","tags":["report"]},{"url":"https://bugzilla.suse.com/1213858","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11879","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-11879","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/evolution/-/commit/6489f20d6905cc797e2b2581c415e558c457caa7","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11879","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-11879","description":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.","status":"published","published":"2020-04-17T17:07:41Z","modified":"2024-08-04T11:42:00.929Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-4219","description":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.","status":"published","published":"2020-04-17T17:07:41Z","modified":"2024-08-04T11:42:00Z","updated_at":"2026-11-03T03:07:41.956166Z"}],"ghsa":[{"id":"GHSA-c29m-85fj-ccfm","title":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068)...","description":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=.bash_history value.","status":"published","published":"2022-05-24T17:15:44Z","modified":"2024-04-04T02:49:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:56:12.154453Z"}],"nvd":[{"id":"CVE-2020-11879","description":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.","status":"published","published":"2020-04-17T18:15:11.773Z","modified":"2026-06-17T02:50:58.153Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:59.125695Z"}],"osv":[{"id":"CVE-2020-11879","description":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.","status":"published","published":"2020-04-17T18:15:11.773Z","modified":"2026-10-24T10:50:36.920207518Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-11879","description":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.","status":"published","published":"2020-04-17T18:15:11.773Z","modified":"2026-10-26T12:02:25.429982277Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-11879","description":"An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) \"mailto?attach=...\" parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.","status":"published","published":"2020-04-17T18:15:00Z","modified":"2026-04-22T12:27:30.517603Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"SUSE-SU-2023:3375-1","title":"Security update for evolution","description":"This update for evolution fixes the following issues:\n\n- CVE-2020-11879: Fixed issue where websites can attach local files to emails by using a proprietary parameter without warning the user (bsc#1169843).\n- Fix some warnings with newer WebKit\n- Handle frame flattening change in WebKitGTK 2.40 (bsc#1213858)\n","status":"published","published":"2023-08-22T15:00:42Z","modified":"2026-02-04T04:38:20.918315Z","updated_at":"2026-11-02T15:53:53.440387Z"}]}}