Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 16 Jul 2012 11:47:59 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Marc Deslauriers <marc.deslauriers@...onical.com>, coley@...us.mitre.org,
        security@...ntu.com, montel@....org
Subject: Re: CVE Request: KDE Pim

* [2012-07-13 10:41:33 -0600] Kurt Seifried wrote:

>On 07/13/2012 06:25 AM, Marc Deslauriers wrote:
>> Hello,
>>
>> Could a CVE please be assigned to the following issue:
>>
>> Javascript and external images were being loaded while rendering
>> HTML email in kmail. The downloaded Javascript was then being
>> interpreted.
>>
>> See:
>>
>> https://projects.kde.org/projects/kde/kdepim/repository/revisions/dbb2f72f4745e00f53031965a9c10b2d6862bd54
>>
>>  https://bugs.launchpad.net/ubuntu/+source/kdepim/+bug/1022690
>>
>> Thanks,
>>
>> Marc.
>
>This seems like a security hardening issue to me, but I'm not a KDE
>person so did kdepim advertise itself as not executing JavaScript/etc?

Doing some digging, it looks like this was introduced in kdepim 4.4, and
would not affect earlier versions.  Can anyone confirm this?

I'm cc'ing Laurent Montel who made the commit, and who should be able to
shed some light as to when the vulnerability was introduced, and also
answer Kurt's question above.

Laurent, any information you can provide would be appreciated.

-- 
Vincent Danen / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ