{"id":"openSUSE-SU-2026:22263-1","summary":"Security update for evolution","details":"This update for evolution fixes the following issues:\n\nChanges in evolution:\n\n- CVE-2026-88859: JavaScript handler incorrectly assigns an\n  attacker-controlled JavaScript URL to an iframe's source when\n  processing a crafted HTML email containing a spoofed vCard\n  control, which can lead to arbitrary JavaScript execution (bsc#1280004)\n","modified":"2026-11-10T20:30:03.947984755Z","published":"2026-11-09T18:36:54Z","related":["CVE-2026-88859"],"upstream":["CVE-2026-88859"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280004"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-88859"}],"affected":[{"package":{"name":"evolution","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/evolution&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.56.2-bp160.4.1"}]}],"ecosystem_specific":{"binaries":[{"evolution-lang":"3.56.2-bp160.4.1","evolution-plugin-bogofilter":"3.56.2-bp160.4.1","evolution-plugin-pst-import":"3.56.2-bp160.4.1","evolution-plugin-spamassassin":"3.56.2-bp160.4.1","evolution-plugin-text-highlight":"3.56.2-bp160.4.1","evolution":"3.56.2-bp160.4.1","evolution-devel":"3.56.2-bp160.4.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22263-1.json"}}],"schema_version":"1.9.2"}