Bug 280231 (CVE-2009-2537)

Summary:	<kde-base/konqueror-4.3.1: memory consumption DOS (CVE-2009-2537)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://www.milw0rm.com/exploits/9160
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2009-08-03 22:14:33 UTC

CVE-2009-2537 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2537):
  KDE Konqueror allows remote attackers to cause a denial of service
  (memory consumption) via a large integer value for the length
  property of a Select object, a related issue to CVE-2009-1692.

Comment 1 Stefan Behte (RETIRED) gentoo-dev

2009-11-07 00:00:27 UTC

kde-base/konqueror-4.3.1 does not crash.

AFAIK 3.5.10 will be removed along with the other kde-3 stuff, but I'm not sure if we could pmask it already?

Comment 2 Jorge Manuel B. S. Vicetto (RETIRED) Gentoo Infrastructure

2009-11-07 13:28:40 UTC

We're going to add the mask for KDE-3.5 today.

Comment 3 Theo Chatzimichos (RETIRED) archtester

2010-01-23 15:23:14 UTC

KDE 3 is not in tree any more. CC us again if you need anything. thanks

Comment 4 Sean Amoss (RETIRED) gentoo-dev

2014-06-01 18:25:30 UTC

This issue has been fixed since Oct 18, 2009. No GLSA will be issued.