Re: CVE Request: KDE Pim

[Vincent Danen <vdanen () redhat com>]

* [2012-07-13 10:41:33 -0600] Kurt Seifried wrote:

> On 07/13/2012 06:25 AM, Marc Deslauriers wrote:
> > Hello,
> >
> > Could a CVE please be assigned to the following issue:
> >
> > Javascript and external images were being loaded while rendering
> > HTML email in kmail. The downloaded Javascript was then being
> > interpreted.
> >
> > See:
> >
> > https://projects.kde.org/projects/kde/kdepim/repository/revisions/dbb2f72f4745e00f53031965a9c10b2d6862bd54
> >
> >  https://bugs.launchpad.net/ubuntu/+source/kdepim/+bug/1022690
> >
> > Thanks,
> >
> > Marc.
>
> This seems like a security hardening issue to me, but I'm not a KDE
> person so did kdepim advertise itself as not executing JavaScript/etc?

Doing some digging, it looks like this was introduced in kdepim 4.4, and
would not affect earlier versions.  Can anyone confirm this?

I'm cc'ing Laurent Montel who made the commit, and who should be able to
shed some light as to when the vulnerability was introduced, and also
answer Kurt's question above.

Laurent, any information you can provide would be appreciated.

--
Vincent Danen / Red Hat Security Response Team