Some vulnerabilities have been reported in Palm WebOS, which can be exploited by malicious people to conduct cross-site scripting attacks and bypass certain security restrictions.

1) Certain unspecified input is not properly sanitised by the Email application before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of the affected device.

2) An unspecified error can be exploited by Plug-in Development Kit (PDK) applications to gain write access to the file system and overwrite arbitrary files.

Successful exploitation of this vulnerability may allow execution of arbitrary code, but requires tricking a user into installing a malicious application.

The vulnerabilities are reported in versions 1.4.5 and 1.4.5.1.

Solution
Upgrade to version 2.1 or later available via the wireless carrier.

Provided and/or discovered by
1) The vendor credits David Belcher, BlackBerry Security Research Group.
2) Reported by the vendor.

Original Advisory
HPSBMI02632 SSRT100379:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02822174

Deep Links
Links available to Secunia VIM customers