oss-sec mailing list archives
CVE: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications
From: Jeff Mitchell <mitchell () kde org>
Date: Mon, 25 Jul 2011 14:51:38 -0400
Hello, We've been made aware of an input validation failure affecting multiple KDE applications. (The details are not yet public as we're working on the fixes.) We'd like a CVE for this. The Arora and Rekonq web browsers are also vulnerable to the same attack vector, and other Qt-based programs may be as well. We're working with the Qt team to help enhance their documentation to warn developers to take care sanitizing their inputs, but it's not actually a Qt flaw. So we're a bit unsure how to proceed here. Do we get separate CVEs for Arora and Rekonq? Do we lump both of those into the same CVE as the KDE applications? I would think the former since other applications may be found to be vulnerable down the line, but wanted to check. (The Rekonq team has been made aware and are currently patching their code; I'm in the process of trying to notify the Arora team.) Thanks, Jeff
Current thread:
- CVE: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications Jeff Mitchell (Jul 25)