evolution: incorrect selection of recipient gpg public key for encrypted mail

The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.

evince: Missing check of number of pages leads to segmentation fault

evince is missing a check on number of pages which can lead to a segmentation fault

gnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync function

gnome-system-log: polkit policy too lax, allows reading arbitrary files on the system

gnome-system-log polkit policy allows arbitrary files on the system to be read

NetworkManager: creating new WPA-secured wireless network results in insecure network being created instead

In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network.

wpa_supplicant: Improper x509v3 certificate and key file paths sanitization

NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection.

xchat: Heap-based buffer overflow by processing UTF-8 line from server containing characters outside BMP

Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat client crash) or execute arbitrary code via a UTF-8 line from server containing characters outside of the Basic Multilingual Plane (BMP).

evolution: IMAP does non-SSL connection when storing to Sent folder

evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obtain login credentials of the victim.

gdk-pixbuf: GIF loader buffer overflow when initializing decompression tables

gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw

evolution: TNEF attachment decoder input sanitization errors (oCERT-2009-013)

Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted email could cause these applications to write data in arbitrary locations on the filesystem, crash, or potentially execute arbitrary code when decoding attachments.

GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision

(WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject

NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.