CVE-2020-11879: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in GNOME Evolution before version 3.35.91, identified as CVE-2020-11879. The issue allows a website or other source of mailto links to make Evolution attach local files or directories to a composed email message without showing a warning to the user, by exploiting the proprietary (non-RFC6068) 'mailto?attach=...' parameter (CVE Mitre, NVD).

The vulnerability exists in the handling of the proprietary 'mailto?attach=...' parameter in GNOME Evolution's email composition functionality. When a user clicks on a malicious mailto link containing this parameter, the application would automatically attach specified local files to the email without displaying any warning dialog to the user (Debian Tracker).

This vulnerability could allow malicious websites to trick users into inadvertently attaching sensitive local files to emails, potentially leading to unauthorized disclosure of private information (CVE Mitre).

The vulnerability can be exploited through specially crafted mailto links that include the attach parameter. An attacker would need to convince a user to click on such a malicious link (NVD).

The issue has been fixed in GNOME Evolution version 3.35.91 and later releases. Users are advised to update to the latest version of the software. The vulnerability has been addressed in various Linux distributions including Debian Bullseye (3.38.3-1+deb11u2), Bookworm (3.46.4-2), and later versions (Debian Tracker).