Bug#1153445: evolution-data-server: CVE-2026-110777: local files inlined from calendar events; backport for 3.56

[Sumit Verma]

Source: evolution-data-server
Version: 3.56.2-9
Severity: important
Tags: security upstream patch

Hi,

CVE-2026-110777: an event with an ATTACH property using a file URI can
cause a local file to be read and uploaded to the calendar server by
inlining it. The tracker lists this as unfixed and I found no Debian bug
for it.

Upstream fixed it in two commits on the gnome-51 branch: 2515ec687 and
15b3c521d. The second is 3d6d491ea on master, the commit the tracker names,
so the tracker entry shows only the follow-up. The 3.62.1 tag contains only
the first commit, so experimental's 3.62.1-2 may also need the second; I
did not inspect that package.

Attached is one squashed backport that applies to both 3.56.2-9 (forky/sid)
and 3.56.2-0+deb13u1 (trixie) after their patch series, with no fuzz or
offset. Its source changes are the upstream ones; commit 1's lines that
commit 2 removes are dropped, and the test registration in
tests/libecal/test-cal-utils.c moved because 3.56's main() differs. I
compared the added lines against both upstream commits and found none that
are not upstream's. Bookworm's 3.46.4-2 is not covered.

The patch adds public API, with upstream's Since tags left as they are:
libecal: e_cal_util_sanitize_untrusted(),
e_cal_util_sanitize_untrusted_full(), ECalUtilUriNeedsChangeFunc
libedata-cal: e_cal_backend_sanitize_untrusted()
The new functions need adding to the symbols files, which the patch does
not do.

Testing is limited. Upstream's /ECalUtils/SanitizeUntrusted test passes on
both versions, run in a small driver against the patched e-cal-util object.
That function does not exist before the patch, so there is no before/after
comparison. I did not build the full package, and did not reproduce the
file upload. The backend and meta-backend changes were not exercised at run
time, and test-cal-meta-backend was not run.

Regards,
Sumit Verma
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20261108/d223c66c/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: evolution-data-server-CVE-2026-110777-3.56.patch
Type: text/x-diff
Size: 32104 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20261108/d223c66c/attachment-0001.patch>