CVE-2009-0547: Evolution 2.22.3.1 checks S/MIME signatures against a copy of the e-mail text within a signed-data blob, no...

Security readout for executives and security teams

This is an old Evolution email-client flaw where an S/MIME signature could appear valid for text different from what the user saw. The business risk is trust abuse: a signed email could mislead recipients using the vulnerable client. The bundle does not show active exploitation or a CVSS score. Likely limited to legacy Linux desktop environments using vulnerable Evolution packages, especially old Fedora, Red Hat, Debian, SUSE, or Mandriva-era systems. Modern, maintained systems are less likely exposed, but inventory should confirm whether Evolution or related mail packages remain installed. Treat as a targeted legacy-client risk, not a broad internet-facing emergency. Prioritize if executives, finance, legal, or security teams rely on S/MIME trust decisions in old Evolution deployments. Mitigation focus: Identify systems with Evolution installed, especially legacy Linux desktops.; Apply relevant vendor or distribution security updates for Evolution packages.; Consult vendor advisories for fixed package details before remediation sign-off..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.