Bug 284138 (CVE-2009-1702)

Summary:	[TRACKER] <net-libs/webkit-gtk-1.1.10: WebKit Location and History XSS (CVE-2009-1702)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	esigra
Priority:	High	Keywords:	Tracker
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1702
Whiteboard:	B4 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	287494
Bug Blocks:

Description Alex Legler (RETIRED) archtester

2009-09-08 11:04:23 UTC

CVE-2009-1702 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1702):
  Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari
  before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod
  touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary
  web script or HTML via vectors related to improper handling of
  Location and History objects.

Comment 1 Tim Sammut (RETIRED) gentoo-dev

2011-01-05 06:12:58 UTC

According to https://bugs.gentoo.org/show_bug.cgi?id=287494#c0, this issue was fixed in =net-libs/webkit-gtk-1.1.10. Updating status to [glsa], so it shows up in reports accordingly.

Comment 2 Chris Reffett (RETIRED) gentoo-dev

2013-09-12 22:19:59 UTC

Presumably all affected versions are gone from tree. Closing as discussed with keytoaster. No GLSA for you.