CVE-2018-12422

Name	CVE-2018-12422
Description	addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the required string length first, and then allocated a large-enough buffer on the heap.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	901665

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
evolution-data-server (PTS)	bullseye	3.38.3-1+deb11u2	fixed
	bookworm	3.46.4-2	fixed
	trixie	3.56.1-2	fixed
	forky, sid	3.56.2-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
evolution-data-server	source	(unstable)	3.28.5-1	unimportant		901665

https://bugzilla.gnome.org/show_bug.cgi?id=796174
https://gitlab.gnome.org/GNOME/evolution-data-server/commit/34bad6173
non-issue, to be rejected