oss-sec mailing list archives
Re: CVE Request: KDE Pim
From: Vincent Danen <vdanen () redhat com>
Date: Mon, 16 Jul 2012 11:47:59 -0600
* [2012-07-13 10:41:33 -0600] Kurt Seifried wrote:
On 07/13/2012 06:25 AM, Marc Deslauriers wrote:Hello, Could a CVE please be assigned to the following issue: Javascript and external images were being loaded while rendering HTML email in kmail. The downloaded Javascript was then being interpreted. See: https://projects.kde.org/projects/kde/kdepim/repository/revisions/dbb2f72f4745e00f53031965a9c10b2d6862bd54 https://bugs.launchpad.net/ubuntu/+source/kdepim/+bug/1022690 Thanks, Marc.This seems like a security hardening issue to me, but I'm not a KDE person so did kdepim advertise itself as not executing JavaScript/etc?
Doing some digging, it looks like this was introduced in kdepim 4.4, and would not affect earlier versions. Can anyone confirm this? I'm cc'ing Laurent Montel who made the commit, and who should be able to shed some light as to when the vulnerability was introduced, and also answer Kurt's question above. Laurent, any information you can provide would be appreciated. -- Vincent Danen / Red Hat Security Response Team
Current thread:
- CVE Request: KDE Pim Marc Deslauriers (Jul 13)
- Re: CVE Request: KDE Pim Kurt Seifried (Jul 13)
- Re: CVE Request: KDE Pim Vincent Danen (Jul 16)
- Re: CVE Request: KDE Pim laurent Montel (Jul 17)
- Re: CVE Request: KDE Pim David Faure (Jul 17)
- Re: CVE Request: KDE Pim Tomas Hoger (Jul 17)
- Re: CVE Request: KDE Pim Vincent Danen (Jul 17)
- Re: CVE Request: KDE Pim Kurt Seifried (Jul 17)
- Re: CVE Request: KDE Pim David Faure (Jul 17)
- Re: CVE Request: KDE Pim Vincent Danen (Jul 16)
- Re: CVE Request: KDE Pim Kurt Seifried (Jul 13)