CVE-2018-15587: debian debian_linux

CVSS: 6.5v3.0MediumModified

AliasesSUSE-SU-2019:1266-1SUSE-SU-2019:1266-2SUSE-SU-2019:1391-1+9 more

Published 11-02-2019Last modified 05-08-2024

Vulnerability summary

CVE-2018-15587 is a medium (CVSS 6.5) vulnerability in debian debian_linux. EPSS estimates a 2.44% chance of exploitation in the next 30 days, higher than 84% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

36/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.0 (NVD)

EPSS score

2.44%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

OPENSUSE-SU-2024:10743-1 RHSA-2020:1080

Timeline

11-02-2019
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.06.5v2.04.3

EPSS trend

Probability

2.44%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

0.00 pp

From 2.44% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.gnome.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected systems

Redhat25 products

evolution< 0:3.28.5-12.el8
evolution-bogofilter< 0:3.28.5-12.el8
evolution-bogofilter-debuginfo< 0:3.28.5-12.el8
evolution-data-server< 0:3.28.5-13.el8
evolution-data-server-debuginfo< 0:3.28.5-13.el8

Show all 25

Suse10 products

evolution&distro=SUSE Linux Enterprise Desktop 12 SP3< 3.22.6-19.9.1
evolution&distro=SUSE Linux Enterprise Desktop 12 SP4< 3.22.6-19.9.1
evolution&distro=SUSE Linux Enterprise Software Development Kit 12 SP3< 3.22.6-19.9.1
evolution&distro=SUSE Linux Enterprise Software Development Kit 12 SP4< 3.22.6-19.9.1
evolution&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 3.22.6-19.9.1

Show all 10

Debian2 products

evolution< 3.30.5-1.1 | < 3.22.6-1+deb9u2 | < 3.12.9~git20141130.241663-1+deb8u1
debian_linuxEOL8.0

Opensuse2 products

evolution&distro=openSUSE Leap 15.0< 3.26.6-lp150.3.3.1
evolution&distro=openSUSE Leap 15.1< 3.26.6-lp151.4.3.1

Ubuntu2 products

evolutionAll versions (No fix recorded)
evolution-data-server< 3.18.5-1ubuntu1.2 | < 3.28.5-0ubuntu0.18.04.2

Gnome1 product

evolution≤ 3.28.2

6 vendors · 42 products

References

39 links

bugzilla.gnome.org/show_bug.cgi?id=796424X Refsource MISCExploitIssue TrackingVendor Advisory
lists.debian.org/debian-lts-announce/2019/04/msg00027.htmlMailing ListX Refsource MLISTThird Party Advisory
www.openwall.com/lists/oss-security/2019/04/30/4Mailing ListX Refsource MLISTThird Party Advisory
seclists.org/fulldisclosure/2019/Apr/38Mailing ListX Refsource FULLDISCThird Party Advisory
packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlX Refsource MISCThird Party AdvisoryVDB Entry
github.com/RUB-NDS/Johnny-You-Are-FiredX Refsource MISC
github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfX Refsource MISC
lists.opensuse.org/opensuse-security-announce/2019-05/msg00047.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2019-05/msg00061.htmlVendor AdvisoryX Refsource SUSE
usn.ubuntu.com/3998-1/Vendor AdvisoryX Refsource UBUNTU

Show all 39 references

www.debian.org/security/2019/dsa-4457Vendor AdvisoryX Refsource DEBIAN
lists.opensuse.org/opensuse-security-announce/2019-06/msg00024.htmlVendor AdvisoryX Refsource SUSE
seclists.org/bugtraq/2019/Jun/7Mailing ListX Refsource BUGTRAQ
www.suse.com/support/update/announcement/2019/suse-su-20191266-1/Advisory
bugzilla.suse.com/1125230REPORT
www.suse.com/security/cve/CVE-2018-15587WEB
www.suse.com/support/update/announcement/2019/suse-su-20191266-2/Advisory
www.suse.com/support/update/announcement/2019/suse-su-20191391-1/Advisory
www.suse.com/support/update/announcement/2019/suse-su-20191391-2/Advisory
access.redhat.com/errata/RHSA-2020:1600Advisory
bugzilla.redhat.com/show_bug.cgi?id=1764818REPORT
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/indexARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1677650REPORT
bugzilla.redhat.com/show_bug.cgi?id=1741091REPORT
bugzilla.redhat.com/show_bug.cgi?id=1765005REPORT
bugzilla.redhat.com/show_bug.cgi?id=1778799REPORT
bugzilla.redhat.com/show_bug.cgi?id=1788478REPORT
bugzilla.redhat.com/show_bug.cgi?id=1753220REPORT
bugzilla.redhat.com/show_bug.cgi?id=1791547REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1600.jsonAdvisory
access.redhat.com/security/cve/CVE-2018-15587REPORT
www.cve.org/CVERecord?id=CVE-2018-15587AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2018-15587Advisory
ubuntu.com/security/CVE-2018-15587REPORT
ubuntu.com/security/notices/USN-3998-1Advisory
security-tracker.debian.org/tracker/CVE-2018-15587Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities