Read the docs
TI-2013-03639 Aliases CVE-2013-4166GHSA-p34q-c63v-mp3m

Information disclosure in GNOME Evolution

Priority LOW 37CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.

Why it matters now

EPSS 0.0189 79th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 8 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNOMEEvolutionup to 3.8.4—No fix listedCNA
GNOMEEvolution Data Serverup to 3.9.5—No fix listedCNA
  • Evolution VendorGNOME Affected up to 3.8.4 Fixed in — No fix listed CNA
  • Evolution Data Server VendorGNOME Affected up to 3.9.5 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:gnome:evolution:*:*:*:*:*:*:*:*up to 3.8.4VulnerableGNOME
cpe:2.3:a:gnome:evolution_data_server:*:*:*:*:*:*:*:*up to 3.9.5VulnerableGNOME
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
  • cpe:2.3:a:gnome:evolution:*:*:*:*:*:*:*:* Versions up to 3.8.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:evolution_data_server:*:*:*:*:*:*:*:* Versions up to 3.9.5 Vulnerable ·GNOME
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2013:1540 Released 2013-11-20 · Red Hat rating Low
    evolution security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Desktop (v. 6) cheese-2.28.1-8.el6, control-center-1:2.28.1-39.el6, control-center-extra-1:2.28.1-39.el6 +26
    • Red Hat Enterprise Linux Desktop Optional (v. 6) control-center-1:2.28.1-39.el6, control-center-devel-1:2.28.1-39.el6, evolution-2.32.3-30.el6 +47
    • Red Hat Enterprise Linux HPC Node (v. 6) gnome-python2-desktop-2.28.0-5.el6, gnome-python2-gnomekeyring-2.28.0-5.el6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) control-center-1:2.28.1-39.el6, control-center-devel-1:2.28.1-39.el6, control-center-extra-1:2.28.1-39.el6 +23
    • Red Hat Enterprise Linux Server (v. 6) cheese-2.28.1-8.el6, control-center-1:2.28.1-39.el6, control-center-1:2.28.1-39.el6.ppc +25
    • Red Hat Enterprise Linux Server Optional (v. 6) control-center-1:2.28.1-39.el6, control-center-devel-1:2.28.1-39.el6, control-center-devel-1:2.28.1-39.el6.ppc +47
    • Red Hat Enterprise Linux Workstation (v. 6) cheese-2.28.1-8.el6, control-center-1:2.28.1-39.el6, control-center-extra-1:2.28.1-39.el6 +29
    • Red Hat Enterprise Linux Workstation Optional (v. 6) control-center-1:2.28.1-39.el6, control-center-devel-1:2.28.1-39.el6, evolution-2.32.3-30.el6 +43

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2013:1540
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2013:1540
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2013:1540
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2013:1540
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2013:1540
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2013:1540
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2013:1540
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2013:1540

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4166
  2. 2026-10-03 Alias added: GHSA-p34q-c63v-mp3m

References

Patch 2

Advisory 3

  • TI-2021-02347 GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown… CVSS 3.1LOW 3.3
  • TI-2008-01063 Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to… CVSS 2.0HIGH 9.3
  • TI-2005-00087 Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users… CVSS 3.1CRITICAL 9.8
  • TI-2016-08767 camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME… CVSS 3.0CRITICAL 9.8
  • TI-2018-08919 addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME… CVSS 3.0CRITICAL 9.8
  • TI-2008-01062 Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows… CVSS 2.0HIGH 7.6
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences