From oss-security: 1) The Konqueror web browser is vulnerable to type confusion leading to memory disclosure. The root cause of this is the same as CVE-2010-0046 reported by Chris Rohlf which affected WebKit. 2) The Konqueror web browser is vulnerable to an out of bounds memory access when accessing the canvas. In this case the vulnerability was identified whilst playing with bug #43813 from Google's Chrome repository. 3) The Konqueror web browser is vulnerable to a NULL pointer dereference leading to a crash. 4) The Konqueror web browser is vulnerable to a "use-after-free" class flaw when the context menu is used whilst the document DOM that is being changed from within Javascript. 1 and 2 are already fixed. 3 and 4 are not fixed.
Are there upstream bug numbers for each of these issues?
After talking with ago, we were able to confirm that all these CVEs are fixed by 4.9.3
CVE-2012-4515 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4515): Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is shown, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by accessing an iframe when it is being updated. CVE-2012-4514 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4514): rendering/render_replaced.cpp in Konqueror in KDE before 4.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted web page, related to "trying to reuse a frame with a null part." CVE-2012-4513 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4513): khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read.
The stabilization has been done, please file the glsa request
Filing a new GLSA request.
Nothing to do for the maintainers here anymore. Yawn. Does anyone still read this?
This issue was resolved and addressed in GLSA 201406-31 at http://security.gentoo.org/glsa/glsa-201406-31.xml by GLSA coordinator Sergey Popov (pinkbyte).
