Cyrusoft Information for VU#980499

Certain MIME types can cause Internet Explorer to execute arbitrary code when rendering HTML

Status

Not Affected

Vendor Statement

Mulberry does not use Internet Explorer to render HTML within Mulberry
itself and is not vulnerable to these kinds of problems. Users can save
HTML attachments to disk and then view those in browsers susceptible to
this problem, but this requires the direct intervention of the user to
explicitly save to disk - simply viewing HTML in Mulberry does not expose
users to these kinds of problems.

Our HTML rendering is a basic styled-text only renderer that does not
execute any form of scripts. This is true on all the platforms we support:
Win32, Mac OS (Classic & X), Solaris, linux.

An official statement about this is available on our website at:

<http://www.cyrusoft.com/mulberry/htmlsecurity.html>

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.