[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <88743937.1126661279735003935.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 21 Jul 2010 13:56:43 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Tim Brown <timb@...-dimension.org.uk>, coley <coley@...re.org>
Subject: Re: Universal XSS in Rekonq
Please use CVE-2010-2536
Thanks.
--
JB
----- "Tim Brown" <timb@...-dimension.org.uk> wrote:
> Hi guys,
>
> Can a CVE be assigned for the universal XSS in Rekonq
> (https://bugs.kde.org/show_bug.cgi?id=217464). Essentially, the error
> page
> displayed when a requested URL is not available includes said URL. If
> said
> URL includes HTML fragments these will be rendered in the context of
> the
> requested URL. If you request something like
> http://wontresolve.twitter.com/"><script>alert(document.cookies)</script>
> then
> you may very well snare your Twitter cookies.
>
> Originally when I reported this bug to the Rekonq developers, it was a
> very
> small project without much following, however Rekonq is starting to
> make its
> way into multiple distros so I thought it was probably time to flag it
> up.
>
> Quick history:
> 05/12/09 Reported by me against Rekonq 0.4
> 05/12/09 Added note that it also appears to affect Qt's demo browser
> 05/12/09 KDE patch kwebkitpart
> 07/12/09 Confirmed by Rekonq developers
> 13/04/10 Reported resolved by developers
> 14/07/10 Retested on 0.5 and found still to be vulnerable
>
> Cheers,
> Tim
> --
> Tim Brown
> <mailto:timb@...-dimension.org.uk>
> <http://www.nth-dimension.org.uk/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
