[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120716174759.GJ9791@redhat.com>
Date: Mon, 16 Jul 2012 11:47:59 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Marc Deslauriers <marc.deslauriers@...onical.com>, coley@...us.mitre.org,
security@...ntu.com, montel@....org
Subject: Re: CVE Request: KDE Pim
* [2012-07-13 10:41:33 -0600] Kurt Seifried wrote:
>On 07/13/2012 06:25 AM, Marc Deslauriers wrote:
>> Hello,
>>
>> Could a CVE please be assigned to the following issue:
>>
>> Javascript and external images were being loaded while rendering
>> HTML email in kmail. The downloaded Javascript was then being
>> interpreted.
>>
>> See:
>>
>> https://projects.kde.org/projects/kde/kdepim/repository/revisions/dbb2f72f4745e00f53031965a9c10b2d6862bd54
>>
>> https://bugs.launchpad.net/ubuntu/+source/kdepim/+bug/1022690
>>
>> Thanks,
>>
>> Marc.
>
>This seems like a security hardening issue to me, but I'm not a KDE
>person so did kdepim advertise itself as not executing JavaScript/etc?
Doing some digging, it looks like this was introduced in kdepim 4.4, and
would not affect earlier versions. Can anyone confirm this?
I'm cc'ing Laurent Montel who made the commit, and who should be able to
shed some light as to when the vulnerability was introduced, and also
answer Kurt's question above.
Laurent, any information you can provide would be appreciated.
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
