CVE-2013-4166 - CVE House
Back to Database
Status published High CVE-2013-4166

The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and...

Vulnerability Description

The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-4166

Credits & Attribution

No credits recorded in the NVD database.

References

More from GNOME

View All →
CVE-2025-7425
Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
High 7.8
CVE-2025-7424
Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes
High 7.5
CVE-2025-49795
Libxml: null pointer dereference leads to denial of service (dos)
High 7.5
CVE-2025-14512
Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow
Medium 6.5
CVE-2025-14087
Glib: glib: buffer underflow in gvariant parser leads to heap corruption
Medium 5.6

Affected Vendor

Affected Software

Evolution, Evolution Data Server
Vulnerable Versions:
3.8.4 and earlier, 3.9.5 and earlier

Timeline

Official Publish: February 6th, 2020
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.