Bug 279187

Summary:

<=kde-base/kdelibs-4.2.4 Remote code execution (CVE-2009-{1687,1698})

Product:

Gentoo Security

Reporter:

Robert Förster <Dessa>

Component:

Vulnerabilities

Assignee:

Gentoo Security <security>

Status:

RESOLVED FIXED

Severity:

normal

CC:

a3li, kde

Priority:

High

Keywords:

InVCS

Version:

unspecified

Hardware:

All

OS:

Linux

Whiteboard:

~1 [noglsa]

Package list:

Runtime testing required:

---

Bug Depends on:

Bug Blocks:

284116

Attachments:

Description	Flags
patch from upstream svn	none
patch from upstream svn	none

Description Robert Förster 2009-07-26 16:12:05 UTC

CVE-2009-1687 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1687):
  The JavaScript garbage collector in WebKit in Apple Safari before 4.0,
  iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1
  does not properly handle allocation failures, which allows remote attackers
  to execute arbitrary code or cause a denial of service (memory corruption
  and application crash) via a crafted HTML document that triggers write
  access to an "offset of a NULL pointer."

CVE-2009-1698 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1698):
  WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone
  OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during
  handling of a Cascading Style Sheets (CSS) attr function call with a large
  numerical argument, which allows remote attackers to execute arbitrary code
  or cause a denial of service (memory corruption and application crash) via
  a crafted HTML document.

Comment 1 Robert Förster 2009-07-26 16:12:40 UTC

Created attachment 199233 [details, diff]
patch from upstream svn

Comment 2 Robert Förster 2009-07-26 16:13:08 UTC

Created attachment 199234 [details, diff]
patch from upstream svn

Comment 3 Tomáš Chvátal (RETIRED) gentoo-dev

2009-07-30 13:30:16 UTC

commited + revbumped.

Comment 4 Stefan Behte (RETIRED) gentoo-dev

2009-09-14 22:34:01 UTC

Closing noglsa, as 4.x is unstable.

Comment 5 Stefan Behte (RETIRED) gentoo-dev

2009-09-14 22:35:50 UTC

*** Bug 284116 has been marked as a duplicate of this bug. ***

Comment 6 Stefan Behte (RETIRED) gentoo-dev

2009-09-14 22:36:43 UTC

*** Bug 284132 has been marked as a duplicate of this bug. ***