Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 275745 (CVE-2009-2121)

Summary: <=www-client/chromium-bin-? buffer overflow (CVE-2009-2121)
Product: Gentoo Security Reporter: Stefan Behte (RETIRED) <craig>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: trivial CC: voyageur
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://googlechromereleases.blogspot.com/2009/06/stable-beta-update-security-fix.html
Whiteboard: ~1 [noglsa]
Package list:
Runtime testing required: ---

Description Stefan Behte (RETIRED) gentoo-dev Security 2009-06-28 20:59:50 UTC
CVE-2009-2121 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2121):
  Buffer overflow in the browser kernel in Google Chrome before
  2.0.172.33 allows remote HTTP servers to cause a denial of service
  (application crash) or possibly execute arbitrary code via a crafted
  response.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2009-06-28 21:02:17 UTC
This is hardmasked, so we do not have to hurry.
Comment 2 Bernard Cafarelli gentoo-dev 2009-06-28 22:47:17 UTC
chromium-bin-9999 is hardmasked, but -0_p* are not (just ~x86 keyworded), so let's fix that one ;)

From http://code.google.com/p/chromium/issues/detail?id=14508, chromium trunk was fixed in revision 18687, so for us it's <=www-client/chromium-bin-0_p18366 vulnerable. I've just removed this version from portage

I've tested the "listener of death" from the bugreport with 0_p19106 (current ebuild in portage), and it did not crash
Comment 3 Stefan Behte (RETIRED) gentoo-dev Security 2009-11-07 00:19:37 UTC
Thanks! Closing noglsa.