Date: Thu, 21 May 2009 18:13:12 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com Subject: Re: CVE Request -- kdebase4 (konqueror) -- Incomplete SSL Certificate support in KDE4 In CVE, we treat the inadvertent prevention of access to security functionality as a bug. There is no direct way that an external attacker can trigger it, and the attacker gets no direct benefit by waiting for it to happen passively. It's only doable by a person doing this to himself/herself. So, this would not get a CVE. - Steve On Tue, 12 May 2009, Jan Lieskovsky wrote: > Hello Steve, > > not sure if original Debian bug  reporter meant this insufficiency, > but  might be interesting for your attention. While this is not > direct security vulnerability, is is preventing users from using > the functionality provided by digital certificates. > > References: >  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526979 >  https://bugs.kde.org/show_bug.cgi?id=185288 >  https://bugzilla.redhat.com/show_bug.cgi?id=500373 > > This issue is present only in Konqueror web browser, as shipped > with the K Desktop Environment 4 (kdebase-4.*). Konqueror in > kdebase3 works fine. > > Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Response Team > >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.