full-disclosure - Re: Kmail <= 1.9.1 (latest) DOS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <28749c0e0610101559j46fcac95iee5bf84dde2a2102@mail.gmail.com>
Date: Tue, 10 Oct 2006 23:59:46 +0100
From: nnp <version5@...il.com>
To: the.soylent <the.soylent@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Kmail <= 1.9.1 (latest) DOS

I have narrowed down the bug. Here is the update:

Description:
Kmail can be crashed due to incorrectly parsing certain HTML elements.
In this case the <img> tag is incorrectly parsed if the src attribute
is a malformed file link.
A sample mail can be found here
http://silenthack.co.uk/nnp/exploits/kmail/imgCrash .

On 10/10/06, the.soylent <the.soylent@...il.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> nnp schrieb:
> > Have you verified this on any other ubuntu systems besides your own?
>
> Confirmed on 6 other systems, also one kubuntu (with kde) is affected.
> all have nvidia, but also some with nvidia are not affected.. strange..
> /soylent
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2.2 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFFK3ByY86qEhC92cgRAhDBAKCARhfI/baRKHqfxQkhHsxim71e0ACfZyAr
> aiBLc3mn5Qd/AHqqTKdxV6w=
> =PmXv
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

-- 
http://silenthack.co.uk

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/