Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execute arbitrary code via a negative SEQUENCE value in GData, which is used as an array index.
- http://www.novell.com/linux/security/advisories/2007_14_sr.html
No PoCs found on GitHub currently.