Bugzilla Bug 118550

Quoting Dirk Mueller: 

>We're planning to release this advisory at the end of next week. It is 
>currently not publically known, treat it with care. 


1. Systems affected:

        KDE 3.2.0 up to including KDE 3.5.0


2. Overview:

        Maksim Orlovich discovered an incorrect bounds check in kjs,
        the Javascript interpreter engine used by Konqueror and other
        parts of KDE, that allows a heap based buffer overflow
        when decoding invalid utf8 encoded URI sequences.


3. Impact:

        Remotely supplied Javascript code can perform a heap overflow
        and crash the web browser or execute arbitrary code.

carlo, as it seems you are also in the kde herd. Will you do the bumping or who
should be added to CC to fix this?

I'll take care.

Created an attachment (id=77368) [details]
post-3.4.3-kdelibs-kjs.diff

Created an attachment (id=77369) [details]
kdelibs-3.4.3-r1.ebuild

cc'ing arch guys for testing and Chris as release coordinator. Advisory should
be out end of the week, as long as it isn't don't spread the patch, please.

How soon on this?  We are planning on doing the release snapshot on Friday
(20060120).  This can be injected into the snapshot later, of course.  I'm just
trying to get an idea of the timetable.

I'm no longer the security contact for hppa and ppc. Added KillerFox (hppa) and
dertobi123 (ppc).

Chris AFAIK the end of the week is the best information I have.

Arch security liaisons please test and report back on this bug.

Missed alpha. :)

Chris: End of the week. I have no idea if the announcement will be released
before or on the 20th or if they shove it on the next monday. That's why I
cc'ed you.

Adding gmsoft, because he has allready kdelibs merged.

Looks good on hppa

Looks good on ppc.

looks good on ppc64: compiles and runs fine. is there an testcase given
anywhere?

Seems fine on x86.

Looks good on alpha.

Please commit with the following stable keywords:

alpha, hppa, ppc, ppc64, x86

amd64 and sparc please test and mark stable.

Removing myself from the list (I'm on x86).

sparc looks fine, please commit with a stable sparc keyword as well

Would somebody actually commit this ebuild? And what about the other versions
of kde in portage 3.4.1, 3.4.2 and 3.5.0? They seem to be affected but i cant
find a new ebuild for them?

Committed.


(In reply to comment #13)
> is there an testcase given anywhere?

Unfortunately not.

(In reply to comment #19)
> And what about the other versions of kde in portage 3.4.1, 3.4.2 and 3.5.0? 

KDE 3.5 is not stable, so it's not relevant for stable testing. I committed a
new ebuild revision of course. Users of the stable tree have to use KDE 3.4.3.

Stable on amd64 too.

this was commited as stable on ppc64. removing us from CC.

Carlo did the commit for us, so we're off the CC.

*** Bug 119728 has been marked as a duplicate of this bug. ***

Removed hppa from CC. Allready stable.

x86 is already marked stable...

ppc already stable ...

removing alpha from CC, they seem to be already stable in the ebuild - ready
for glsa.

Just in time for slashdot... :-)
http://it.slashdot.org/it/06/01/21/0936249.shtml

GLSA 200601-11