1) The Konqueror web browser is vulnerable to type confusion
leading to memory disclosure. The root cause of this is the same
as CVE-2010-0046 reported by Chris Rohlf which affected WebKit.
2) The Konqueror web browser is vulnerable to an out of bounds
memory access when accessing the canvas. In this case the
vulnerability was identified whilst playing with bug #43813 from
Google's Chrome repository.
3) The Konqueror web browser is vulnerable to a NULL pointer
dereference leading to a crash.
4) The Konqueror web browser is vulnerable to a "use-after-free"
class flaw when the context menu is used whilst the document DOM
1 and 2 are already fixed.
3 and 4 are not fixed.
Are there upstream bug numbers for each of these issues?
After talking with ago, we were able to confirm that all these CVEs are fixed by 4.9.3
Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in
Konqueror in KDE 4.7.3, when the context menu is shown, allows remote
attackers to cause a denial of service (crash) and possibly execute
arbitrary code by accessing an iframe when it is being updated.
rendering/render_replaced.cpp in Konqueror in KDE before 4.9.3 allows remote
attackers to cause a denial of service (NULL pointer dereference) via a
crafted web page, related to "trying to reuse a frame with a null part."
khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote
attackers to cause a denial of service (crash) and possibly read memory via
large canvas dimensions, which leads to an unexpected sign extension and a
heap-based buffer over-read.
The stabilization has been done, please file the glsa request
Filing a new GLSA request.
Nothing to do for the maintainers here anymore. Yawn. Does anyone still read this?
This issue was resolved and addressed in
GLSA 201406-31 at http://security.gentoo.org/glsa/glsa-201406-31.xml
by GLSA coordinator Sergey Popov (pinkbyte).