Evolution vulnerability via HTML frames

[Till Ulen]

Binary package hint: evolution

Juan Pablo Lopez Yacubian reported the following vulnerability to Bugtraq:
http://www.securityfocus.com/archive/1/493686/30/0/threaded

[Pedro Villavicencio (pedro)]

this has been fixed upstream, comments for further SRU:

"Patch committed to SVN stable (gnome-2-22) branch as r8880
http://svn.gnome.org/viewvc/gtkhtml?view=revision&revision=8880

Patch committed to SVN trunk as r8881
http://svn.gnome.org/viewvc/gtkhtml?view=revision&revision=8881
"

Thanks for reporting.

[Jamie Strandboge (jdstrand)]

This does not appear to be a serious security bug because it requires the user to insert a malicious html file into the mail composer. Based on the patch and (limited) blackbox testing, this does not appear to be remotely exploitable (eg via a crafted html email). The patch fixes reparent_embedded() in gtkhtml.c. This function is called by gtk_html_insert_html_generic(), which is in turn called by gtk_html_insert_html(), gtk_html_insert_gtk_html() and gtk_html_append_html(). These functions are only called via clipboard_paste_received_cb() and code from components/html-editor/engine.c.

I am going to set the priority to Low, as it appears to be just a crasher and requires user assistance.

[Sebastien Bacher (seb128)]

the new gtkhtml stable version has already been uploaded as an hardy update

[Martin Pitt (pitti)]

Accepted into -proposed, please test and give feedback here. Please see https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Sebastien Bacher (seb128)]

a new rebuild revision has been uploaded now to some libglib issues, would be nice to give testing to this one too

[Sebastien Bacher (seb128)]

the new version is in intrepid

[Sebastien Bacher (seb128)]

the new version is in hardy-updates now

[Steve Beattie (sbeattie)]

Is this gtkhtml issue valid for Feisty and Gutsy, and if so, are we going to address this issue in those releases, or, given the low severity of the security vulnerability, should we close those tasks?

Dapper does not appear to include gtkhtml3.14, so I'm marking that task as invalid.

[Henrik Nilsen Omma (henrik)]

Feisty is end-of-life -> Won't Fix.

[Henrik Nilsen Omma (henrik)]

IMO this does not qualify as a high-impact bug in Gutsy, following the guidelines in https://wiki.ubuntu.com/StableReleaseUpdates -> Closing task.