oss-sec mailing list archives
Re: CVE request - asterisk, python-markdown, jetty, kde
From: Tim Brown <tmb () 65535 com>
Date: Wed, 4 Nov 2009 15:39:08 +0000
On Thursday 29 October 2009 22:11:32 Tim Brown wrote:
On Thursday 29 October 2009 20:10:27 Tomas Hoger wrote:On Thu, 29 Oct 2009 09:42:36 -0600 Raphael Geissert <geissert () debian org> wrote:= kde = Multiple missing input sanity checks in KDE Reference: http://www.ocert.org/advisories/ocert-2009-015.htmlBtw, do you have any suggestion on how many CVEs should be allocated here and what are the individual flaws? I failed to build satisfying list form the info in the advisory. Have you managed to tell which patch is supposed to address which vulnerability?I've responded to Tomas off list regarding these issues since our advisories have not yet been made available. We have 4 advisories to cover the individual flaws. If anyone else wants further details in the meantime, feel free to get in touch off list but I'll likely only respond to people I can validate (i.e. package maintainers for the distros etc).
Our advisories are now up at http://www.portcullis-security.com/advisories: * Portcullis Security Advisory 09-008 Insufficient Input Validation By IO Slaves * Portcullis Security Advisory 09-004 KMail Attachment Mime Type Spoofing Enables Javascript Injection * Portcullis Security Advisory 09-003 Form Spoofing In Konqueror Enables KWallet Stored Credential Theft * Portcullis Security Advisory 09-002 Ark Default View Allows JavaScript Injection Note that Tomas and I had quite a long discussion off list, I'll try and summarise that as an update later tonight. The key points are that that KDE determined that 09-003 would not be fixed and that KDE determined that the PoCs for 09-004 and 09-002 were possible due to a same origin policy violation and fixed that. Tim -- Tim Brown <mailto:tmb () 65535 com>
Current thread:
- CVE request - asterisk, python-markdown, jetty, kde Raphael Geissert (Oct 29)
- Re: CVE request - asterisk, python-markdown, jetty, kde Mark J Cox (Oct 29)
- Re: CVE request - asterisk, python-markdown, jetty, kde Raphael Geissert (Nov 23)
- Re: CVE request - asterisk, python-markdown, jetty, kde Tomas Hoger (Oct 29)
- Re: CVE request - asterisk, python-markdown, jetty, kde Tim Brown (Oct 29)
- Re: CVE request - asterisk, python-markdown, jetty, kde Tim Brown (Nov 04)
- Re: CVE request - asterisk, python-markdown, jetty, kde Tim Brown (Oct 29)
- Re: CVE request - asterisk, python-markdown, jetty, kde Mark J Cox (Oct 29)