Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 16 Jul 2012 11:47:59 -0600
From: Vincent Danen <>
Cc: Marc Deslauriers <>,,,
Subject: Re: CVE Request: KDE Pim

* [2012-07-13 10:41:33 -0600] Kurt Seifried wrote:

>On 07/13/2012 06:25 AM, Marc Deslauriers wrote:
>> Hello,
>> Could a CVE please be assigned to the following issue:
>> Javascript and external images were being loaded while rendering
>> HTML email in kmail. The downloaded Javascript was then being
>> interpreted.
>> See:
>> Thanks,
>> Marc.
>This seems like a security hardening issue to me, but I'm not a KDE
>person so did kdepim advertise itself as not executing JavaScript/etc?

Doing some digging, it looks like this was introduced in kdepim 4.4, and
would not affect earlier versions.  Can anyone confirm this?

I'm cc'ing Laurent Montel who made the commit, and who should be able to
shed some light as to when the vulnerability was introduced, and also
answer Kurt's question above.

Laurent, any information you can provide would be appreciated.

Vincent Danen / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.