{"schemaVersion":3,"id":"CVE-2009-0547","aliases":["DEBIAN-CVE-2009-0547"],"status":"published","duplicateOf":null,"title":null,"description":"Evolution 2.22.3.1 checks S/MIME signatures against a copy of the e-mail text within a signed-data blob, not the copy of the e-mail text displayed to the user, which allows remote attackers to spoof a signature by modifying the latter copy, a different vulnerability than CVE-2008-5077.","dates":{"published":"2009-02-12T23:00:00.000Z","modified":"2024-08-07T04:40:04.121Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02216,"percentile":0.82394,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.02216},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02216,"percentile":0.82394}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02216,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02216,"percentile":0.82394}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-310","name":"Cryptographic Issues","description":"Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.","type":"category","status":"Draft","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/310.html"}],"affected":[{"vendor":"debian","product":"evolution-data-server","name":"evolution-data-server","label":"evolution-data-server","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/evolution-data-server","purlType":"deb","versions":[{"text":"< 2.24.5-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.24.5-2","eol":null,"hubHref":null},{"vendor":"evolution","product":"evolution","name":"evolution","label":"evolution","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.22.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.22.3.1","eol":null,"hubHref":"/vendor/evolution/evolution"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://secunia.com/advisories/35357","label":"secunia.com/advisories/35357","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/bid/33720","label":"www.securityfocus.com/bid/33720","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.vupen.com/english/advisories/2010/1107","label":"www.vupen.com/english/advisories/2010/1107","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00672.html","label":"www.redhat.com/archives/fedora-package-announce/2009-March/msg00672.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html","label":"lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=484925","label":"bugzilla.redhat.com/show_bug.cgi?id=484925","hostname":"bugzilla.redhat.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/34339","label":"secunia.com/advisories/34339","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://openwall.com/lists/oss-security/2009/02/10/7","label":"openwall.com/lists/oss-security/2009/02/10/7","hostname":"openwall.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://secunia.com/advisories/34363","label":"secunia.com/advisories/34363","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2009-0355.html","label":"www.redhat.com/support/errata/RHSA-2009-0355.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508479","label":"bugs.debian.org/cgi-bin/bugreport.cgi?bug=508479","hostname":"bugs.debian.org","tags":["X Refsource MISC"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html","label":"lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://bugzilla.gnome.org/show_bug.cgi?id=564465","label":"bugzilla.gnome.org/show_bug.cgi?id=564465","hostname":"bugzilla.gnome.org","tags":["X Refsource CONFIRM"]},{"url":"http://www.debian.org/security/2009/dsa-1813","label":"www.debian.org/security/2009/dsa-1813","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html","label":"lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://www.redhat.com/support/errata/RHSA-2009-0354.html","label":"www.redhat.com/support/errata/RHSA-2009-0354.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9619","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9619","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://secunia.com/advisories/34338","label":"secunia.com/advisories/34338","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00666.html","label":"www.redhat.com/archives/fedora-package-announce/2009-March/msg00666.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:078","label":"www.mandriva.com/security/advisories?name=MDVSA-2009:078","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://secunia.com/advisories/38915","label":"secunia.com/advisories/38915","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/33848","label":"secunia.com/advisories/33848","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-0547","label":"security-tracker.debian.org/tracker/CVE-2009-0547","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-1813-1","RHSA-2009:0354","RHSA-2009:0355"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2009-02-12T23:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T04:40:04.121Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":20,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T04:59:50.248Z","stale":false,"partial":false}}