oss-security - CVE Request: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E2DBB43.30402@kde.org>
Date: Mon, 25 Jul 2011 14:51:47 -0400
From: Jeff Mitchell <mitchell@....org>
To: oss-security@...ts.openwall.com, KDE Security Team <security@....org>, 
 security@...nokia.com, Tim Brown <timb@...-dimension.org.uk>
Subject: CVE Request: Input validation failure affecting multiple KDE applications,
 as well as many other Qt-based applications

Hello,

We've been made aware of an input validation failure affecting multiple
KDE applications. (The details are not yet public as we're working on
the fixes.) We'd like a CVE for this.

The Arora and Rekonq web browsers are also vulnerable to the same attack
vector, and other Qt-based programs may be as well. We're working with
the Qt team to help enhance their documentation to warn developers to
take care sanitizing their inputs, but it's not actually a Qt flaw. So
we're a bit unsure how to proceed here. Do we get separate CVEs for
Arora and Rekonq? Do we lump both of those into the same CVE as the KDE
applications? I would think the former since other applications may be
found to be vulnerable down the line, but wanted to check.

(The Rekonq team has been made aware and are currently patching their
code; I'm in the process of trying to notify the Arora team.)

Thanks,
Jeff

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.