oss-sec mailing list archives
CVE-2014-8873 was fixed in DSA-3235-1
From: Florian Weimer <fw () deneb enyo de>
Date: Sat, 18 Jul 2015 14:13:26 +0200
We failed to mention in the original Debian security advisory that the openjdk-7 update in DSA-3235-1 also fixed the following Debian-specific vulnerability: Some web browsers in Debian jessie would automatically execute downloaded JAR files, without any kind of sandbox. Presumably, that affects email clients as well. We have tracked this down to the /etc/mailcap entry generated from the openjdk-7 .desktop file, after this change in mime-support (which is specific to Debian and its downstreams): mime-support (3.53) unstable; urgency=low 801bd8b Parse Desktop entries to generate mailcap entries. Patch from Brian M. Carlson. (Closes: #497779) -- Charles Plessy <plessy () debian org> Sun, 05 May 2013 17:24:50 +0900 This change is part of Debian jessie, previous releases are not affected. After consultation with the mime-support maintainers, the resolution in DSA-3235-1 removes the MIME type registration from the openjdk-7 package. Auto-generation of /etc/mailcap from .desktop files remains the intended behavior of the mime-support package. The unintended code execution was reported initially to MITRE by Alexander Neumann, and MITRE assigned CVE-2014-8873 to this issue, without a full root cause analysis, incorrectly assuming it was a w3m (and not Debian) vulnerability. For other packages with .desktop files affected in the same way, we will assign separate CVE IDs from Debian's pool. We do not believe any of the affected packages are in the supported package set of any Debian downstream.
Current thread:
- CVE-2014-8873 was fixed in DSA-3235-1 Florian Weimer (Jul 18)