Date: Sat, 18 Jul 2015 14:13:26 +0200 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: CVE-2014-8873 was fixed in DSA-3235-1 We failed to mention in the original Debian security advisory that the openjdk-7 update in DSA-3235-1 also fixed the following Debian-specific vulnerability: Some web browsers in Debian jessie would automatically execute downloaded JAR files, without any kind of sandbox. Presumably, that affects email clients as well. We have tracked this down to the /etc/mailcap entry generated from the openjdk-7 .desktop file, after this change in mime-support (which is specific to Debian and its downstreams): mime-support (3.53) unstable; urgency=low 801bd8b Parse Desktop entries to generate mailcap entries. Patch from Brian M. Carlson. (Closes: #497779) -- Charles Plessy <plessy@...ian.org> Sun, 05 May 2013 17:24:50 +0900 This change is part of Debian jessie, previous releases are not affected. After consultation with the mime-support maintainers, the resolution in DSA-3235-1 removes the MIME type registration from the openjdk-7 package. Auto-generation of /etc/mailcap from .desktop files remains the intended behavior of the mime-support package. The unintended code execution was reported initially to MITRE by Alexander Neumann, and MITRE assigned CVE-2014-8873 to this issue, without a full root cause analysis, incorrectly assuming it was a w3m (and not Debian) vulnerability. For other packages with .desktop files affected in the same way, we will assign separate CVE IDs from Debian's pool. We do not believe any of the affected packages are in the supported package set of any Debian downstream.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.