Date: Wed, 28 Nov 2012 18:13:42 +0100 From: Ricardo Mones <ricardo@...es.org> To: Vincent Danen <vdanen@...hat.com> Cc: oss-security@...ts.openwall.com Subject: Re: CVE request -- vCalendar plugin for Claws Mail: credentials exposed on interface Hi Vincent, On Wed, Nov 28, 2012 at 09:44:53AM -0700, Vincent Danen wrote: > * [2012-11-15 13:36:13 +0100] Ricardo Mones wrote: > > > This has been reported on our bugzilla: > > http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=2782 > > > > There's still not fix available. Could a CVE id be allocated for this if > >appropriate? > > > > thanks in advance, > > > >P.S.: I'm not subscribed to the list. > > I don't know if this ever got a CVE or not; if it did I don't see a > reference. > > Also, according to this bug report it's fixed, but I can't find the > patch in your CVS tracker. Can you provide a link to it? Unfortunately tracker only tracks changes to core, not to plugins, but the patch it's commited also into the Debian packaging, so this link may serve: http://anonscm.debian.org/gitweb/?p=users/mones/claws-mail-extra-plugins.git;a=commitdiff;h=a3f91d21b32dd0b63b28ccb0c6f7a73939b14c9a > And, if a CVE hasn't been assigned, perhaps Kurt or someone could assign > one? It't got one, but seems the list was not included in recipients: > Please use CVE-2012-5527 for this issue. regards, -- Ricardo Mones ~ 00:45 < hammar> cool.. have you used rssyl? 00:46 <@Ticho> um, yes Seen on #sylpheed Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.