<html>
<head>
<base href="https://bugzilla.rosalinux.ru/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Platform</th>
<td>2021.1
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_CONFIRMED "
title="CONFIRMED - [CVE 21] xdg-utils 1.1.3 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13344">13344</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[CVE 21] xdg-utils 1.1.3 CVEs found
</td>
</tr>
<tr>
<th>Classification</th>
<td>ROSA-based products
</td>
</tr>
<tr>
<th>Product</th>
<td>ROSA Fresh
</td>
</tr>
<tr>
<th>Version</th>
<td>All
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>URL</th>
<td>CVE-2020-27748,
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>CONFIRMED
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>Normal
</td>
</tr>
<tr>
<th>Component</th>
<td>System (kernel, glibc, systemd, bash, PAM...)
</td>
</tr>
<tr>
<th>Assignee</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>Reporter</th>
<td>y.tumanov@rosalinux.ru
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>CC</th>
<td>s.matveev@rosalinux.ru, y.tumanov@rosalinux.ru
</td>
</tr>
<tr>
<th>Target Milestone</th>
<td>---
</td>
</tr>
<tr>
<th>Flags</th>
<td>secteam_verified?
</td>
</tr></table>
<p>
<div>
<pre>Please patch CVEs for package xdg-utils version 1.1.3
INFO (CVEs are): xdg-utils 1.1.3
cves found
CVE-2020-27748
Desc: A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and
newer. When handling mailto: URIs, xdg-email allows attachments to be
discreetly added via the URI when being passed to Thunderbird. An attacker
could potentially send a victim a URI that automatically attaches a sensitive
file to a new email. If a victim user does not notice that an attachment was
added and sends the email, this could result in sensitive information
disclosure. It has been confirmed that the code behind this issue is in
xdg-email and not in Thunderbird.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-27748">https://nvd.nist.gov/vuln/detail/CVE-2020-27748</a>
Severity: MEDIUM</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>