Bug 284124 (CVE-2009-1692)

Summary:	[TRACKER] <net-libs/webkit-gtk-1.1.10: WebKit HTMLSelectElement ACE/DoS (CVE-2009-1692)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	esigra
Priority:	High	Keywords:	Tracker
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1692
Whiteboard:	B2 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	287494
Bug Blocks:

Description Alex Legler (RETIRED) archtester

2009-09-08 11:03:13 UTC

CVE-2009-1692 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1692):
  WebKit before r41741, as used in Apple iPhone OS 1.0 through 2.2.1,
  iPhone OS for iPod touch 1.1 through 2.2.1, Safari, and other
  software, allows remote attackers to cause a denial of service
  (memory consumption or device reset) via a web page containing an
  HTMLSelectElement object with a large length attribute, related to
  the length property of a Select object.

Comment 1 Tim Sammut (RETIRED) gentoo-dev

2011-01-05 06:09:23 UTC

According to https://bugs.gentoo.org/show_bug.cgi?id=287494#c0, this issue was fixed in =net-libs/webkit-gtk-1.1.10. Updating status to [glsa], so it shows up in reports accordingly.

Comment 2 Chris Reffett (RETIRED) gentoo-dev

2013-09-12 22:16:39 UTC

Presumably all affected versions are gone from tree. Closing as discussed with keytoaster. No GLSA for you.