CVE-2006-0528

Name	CVE-2006-0528
Description	The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
evolution (PTS)	buster	3.30.5-1.1	fixed
	bullseye	3.38.3-1+deb11u1	fixed
	bullseye (security)	3.38.3-1+deb11u2	fixed
	bookworm	3.46.4-2	fixed
	sid	3.48.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
evolution	source	woody	(not affected)
evolution	source	sarge	(not affected)
evolution	source	(unstable)	2.2.3-4	low

Notes

[sarge] - evolution <not-affected> (Vulnerability was apparantly introduced in 2.3.1)
[woody] - evolution <not-affected> (Vulnerability was apparantly introduced in 2.3.1)