Date: Tue, 4 Mar 2014 10:03:01 +0100 From: Hanno Böck <hanno@...eck.de> To: OSS Security List <oss-security@...ts.openwall.com> Subject: CVE request: konqueror not providing any protection against clickjacking Hi, It may be debatable if that's a CVE issue, because it's basically a "there's a general vulnerability in the way HTML/JS is done, there's a protection mechanism and product X doesn't have it". I think it deserves one and as recently Konqueror issues popped up here I thought it might deserve a CVE: https://bugs.kde.org/show_bug.cgi?id=259070 Basically, pretty much all mainstream browsers support the X-Frame-Options header to allow web developers to secure their apps from clickjacking attacks. Konqueror doesn't support it. Please assign CVE. (and if curious: I've setup a test for X-FRAME-OPTIONS header functionality a while ago http://int21.de/frametest/ ) cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.