Skip to content
Fencer Vulns
medium 5.9

CVE-2020-16117 json

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an i…

published 2020-07-29 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-8083

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.

Patch / fix

  • gnome evolution-data-server 3.35.91
  • evolution-data-server Debian 14, Debian 13, Debian 12 3.36.0-1

debian advisories DEBIAN-CVE-2020-16117

  • evolution RHEL 8 3.28.5-16.el8
  • evolution-ews RHEL 8 3.28.5-10.el8
  • evolution-pst RHEL 8 3.28.5-16.el8
  • evolution-help RHEL 8 3.28.5-16.el8
  • evolution-langpacks RHEL 8 3.28.5-16.el8
  • evolution-bogofilter RHEL 8 3.28.5-16.el8
  • evolution-data-server RHEL 8 3.28.5-15.el8
  • evolution-spamassassin RHEL 8 3.28.5-16.el8

red hat advisories RHSA-2021:1752

  • evolution-data-server SLE Workstation Extension 15 SP2 3.34.4-3.3.1
  • evolution-ews SLE Workstation Extension 15 SP2 3.34.4-3.3.1
  • evolution-data-server SLE Workstation Extension 12 SP5, SLE Software Development Kit 12 SP5 3.22.7-18.7.1
  • evolution-data-server SLE Workstation Extension 12 SP5 3.20.6-17.3.1

suse advisories SUSE-SU-2021:0949-1SUSE-SU-2021:0891-1SUSE-SU-2021:0885-1

  • evolution-data-server openSUSE Tumbleweed 3.40.4-1.4
  • evolution-data-server openSUSE Leap 15.2 3.34.4-lp152.2.3.1
  • evolution-ews openSUSE Leap 15.2 3.34.4-lp152.2.3.1

opensuse advisories openSUSE-SU-2024:10744-1openSUSE-SU-2021:0482-1

  • evolution-data-server-perl AlmaLinux 8 3.28.5-15.el8
  • evolution-data-server-tests AlmaLinux 8 3.28.5-15.el8

almalinux advisories ALSA-2021:1752

  • evolution Rocky Linux 8 3.28.5-16.el8
  • evolution-ews Rocky Linux 8 3.28.5-10.el8
  • evolution-data-server Rocky Linux 8 3.28.5-15.el8

rocky linux advisories RLSA-2021:1752

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-16117 updated cvss 5.9

evolution-data-server: NULL pointer dereference related to imapx_free_capability and imapx_connect_to_server

  • Red Hat Enterprise Linux 5 evolution-data-server Red Hat Enterprise Linux 6 evolution-data-server
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 evolution-data-server, evolution-data-server-perl, evolution-data-server-tests, evolution-data-server-langpacks
    affected: no fix available “Fix deferred”
  • Red Hat CodeReady Linux Builder (v. 8) evolution-data-server-perl 3.28.5-15.el8, evolution-data-server-tests 3.28.5-15.el8 Red Hat Enterprise Linux AppStream (v. 8) evolution 3.28.5-16.el8, evolution-ews 3.28.5-10.el8, evolution-pst 3.28.5-16.el8, evolution-help 3.28.5-16.el8, evolution-langpacks 3.28.5-16.el8, evolution-bogofilter 3.28.5-16.el8, +4 more
    fixed: vendor fix RHSA-2021:1752

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.97% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.gnome.org https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/189 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.