Bug 281818 (CVE-2009-1725)

Summary:

[Tracker] WebKit "numeric character references" ACE (CVE-2009-1725)

Product:

Gentoo Security

Reporter:

Alex Legler (RETIRED) <a3li>

Component:

Vulnerabilities

Assignee:

Gentoo Security <security>

Status:

RESOLVED FIXED

Severity:

normal

CC:

esigra

Priority:

High

Keywords:

Tracker

Version:

unspecified

Hardware:

All

OS:

Linux

URL:

http://support.apple.com/kb/HT3666

Whiteboard:

B2 [ebuild/stable blocked]

Package list:

Runtime testing required:

---

Bug Depends on:

279027, 281819, 281821

Bug Blocks:

Attachments:

Description	Flags
webkit-CVE-2009-1725.patch	none

Description Alex Legler (RETIRED) archtester

2009-08-17 16:16:39 UTC

CVE-2009-1725 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1725):
  WebKit in Apple Safari before 4.0.2 does not properly handle numeric
  character references, which allows remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and
  application crash) via a crafted HTML document.

Comment 1 Alex Legler (RETIRED) archtester

2009-08-17 16:25:15 UTC

Bug 279027 - kdelibs
Bug 281819 - webkit-gtk
Bug 281821 - qt-webkit

Comment 2 Alex Legler (RETIRED) archtester

2009-08-17 16:26:56 UTC

Created attachment 201549 [details, diff]
webkit-CVE-2009-1725.patch

Official upstream patch

Comment 3 Chris Reffett (RETIRED) gentoo-dev

2013-09-12 22:15:49 UTC

Presumably all affected versions are gone from tree. Closing as discussed with keytoaster.