CVE-2013-4166

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
GNOME	Evolution	3.8.4 and earlier
GNOME	Evolution Data Server	3.9.5 and earlier

References

http://rhn.redhat.com/errata/RHSA-2013-1540.htmlThird Party Advisory
http://seclists.org/oss-sec/2013/q3/191Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=973728Issue Tracking, Third Party Advisory
https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142ec9515708d8ae5Patch, Vendor Advisory
https://git.gnome.org/browse/evolution-data-server/commit/?id=5d8b92c622f6927b253762ff9310479dd3ac627dPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1540.htmlThird Party Advisory
http://seclists.org/oss-sec/2013/q3/191Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=973728Issue Tracking, Third Party Advisory
https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142ec9515708d8ae5Patch, Vendor Advisory
https://git.gnome.org/browse/evolution-data-server/commit/?id=5d8b92c622f6927b253762ff9310479dd3ac627dPatch, Vendor Advisory

Timeline

Published: Feb 6, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-41674.3Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or CVE-2013-41686.1Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields.CVE-2013-41696.9GNOME Display Manager (gdm) before 2.21.1 allows local users to change permissions of arbitrary directories via a symlink attack on /tmp/.X1 CVE-2013-41706.1In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the CVE-2013-41714.3Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or H CVE-2013-41728.5The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.CVE-2013-41735.0Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitra CVE-2013-41744.3Multiple cross-site scripting (XSS) vulnerabilities in the Scald module 7.x-1.x before 7.x-1.1 for Drupal allow remote attackers to inject a CVE-2013-41755.5MySecureShell 1.31 has a Local Denial of Service Vulnerability CVE-2013-41765.5mysecureshell 1.31: Local Information Disclosure Vulnerability CVE-2013-41775.0The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account n CVE-2013-41785.0The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access