openSUSE-SU-2026:22263-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22263-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22263-1
- Upstream
- CVE-2026-88859
- Related
- Published
- 2026-11-09T18:36:54Z
- Modified
- 2026-11-10T20:30:03Z
- Summary
- Security update for evolution
- Details
-
This update for evolution fixes the following issues:
Changes in evolution:
- CVE-2026-88859: JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source when processing a crafted HTML email containing a spoofed vCard control, which can lead to arbitrary JavaScript execution (bsc#1280004)
- References
Affected packages
openSUSE:Leap 16.0 / evolution
Package
- Name
- evolution
- Purl
- pkg:rpm/opensuse/evolution&distro=openSUSE%20Leap%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.56.2-bp160.4.1
Ecosystem specific
{
"binaries": [
{
"evolution": "3.56.2-bp160.4.1",
"evolution-devel": "3.56.2-bp160.4.1",
"evolution-lang": "3.56.2-bp160.4.1",
"evolution-plugin-bogofilter": "3.56.2-bp160.4.1",
"evolution-plugin-pst-import": "3.56.2-bp160.4.1",
"evolution-plugin-spamassassin": "3.56.2-bp160.4.1",
"evolution-plugin-text-highlight": "3.56.2-bp160.4.1"
}
]
}