[SECURITY] Fedora 9 Update: evolution-data-server-2.22.3-3.fc9

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2009-2792
2009-03-18 18:32:42
--------------------------------------------------------------------------------

Name        : evolution-data-server
Product     : Fedora 9
Version     : 2.22.3
Release     : 3.fc9
URL         : http://www.gnome.org/projects/evolution/
Summary     : Backend data server for Evolution
Description :
The evolution-data-server package provides a unified backend for programs that work
with contacts, tasks, and calendar information.

It was originally developed for Evolution (hence the name), but is now used
by other packages.

--------------------------------------------------------------------------------
Update Information:

This update fixes two security issues:    Evolution Data Server did not properly
check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used
for public key encryption and signing of e-mail messages. An attacker could use
this flaw to spoof a signature by modifying the text of the e-mail message
displayed to the user. (CVE-2009-0547)    It was discovered that Evolution Data
Server did not properly validate NTLM (NT LAN Manager) authentication challenge
packets. A malicious server using NTLM authentication could cause an application
using Evolution Data Server to disclose portions of its memory or crash during
user authentication. (CVE-2009-0582)
--------------------------------------------------------------------------------
ChangeLog:

* Tue Mar 17 2009 Matthew Barnes <mbarnes at redhat.com> - 2.22.3-3.fc9
- Add patch for RH bug #484925 (CVE-2009-0547, S/MIME signatures).
- Add patch for RH bug #487685 (CVE-2009-0582, NTLM authentication).
* Tue Jul  8 2008 Matthew Barnes <mbarnes at redhat.com> - 2.22.3-2.fc9
- Add patch for GNOME bug #537415 (infinite loop in GAL authentication).
* Mon Jun 30 2008 Matthew Barnes <mbarnes at redhat.com> - 2.22.3-1.fc9
- Update to 2.22.3
* Thu Jun 19 2008 Matthew Barnes <mbarnes at redhat.com> - 2.22.2-2.fc9
- Rebuild against libldap.a w/ NTLM support in openldap-2.4.8-5.fc9 to
  pick up fix in RH bug #450017.
* Mon May 26 2008 Matthew Barnes <mbarnes at redhat.com> - 2.22.2-1.fc9
- Update to 2.22.2
- Remove patch for GNOME bug #531439 (fixed upstream).
* Sun May 18 2008 Matthew Barnes <mbarnes at redhat.com> - 2.22.1.1-2.fc9
- Add patch for GNOME bug #531439 (GPG passphrases destroys passwords).
* Fri May  2 2008 Matthew Barnes <mbarnes at redhat.com> - 2.22.1.1-1.fc9
- Update to 2.22.1.1
- Remove patch for GNOME bug #530323 (fixed upstream).
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #484925 - CVE-2009-0547 evolution-data-server: S/MIME signatures are considered to be valid even for modified messages (MITM)
        https://bugzilla.redhat.com/show_bug.cgi?id=484925
  [ 2 ] Bug #487685 - CVE-2009-0582 evolution-data-server: insufficient checking of NTLM authentication challenge packets
        https://bugzilla.redhat.com/show_bug.cgi?id=487685
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update evolution-data-server' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------