webkit: multiple security issues

Debian Bug report logs - #559759
webkit: multiple security issues

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: submit@bugs.debian.org

Subject: webkit: multiple security issues

Date: Sun, 6 Dec 2009 17:33:20 -0500

Package: webkit
Version: 1.0.1-4
Severity: serious
Tags: security

Hi,
the following CVE (Common Vulnerabilities & Exposures) ids were
published for webkit.

CVE-2009-3384[1]:
| Multiple unspecified vulnerabilities in WebKit in Apple Safari before
| 4.0.4 on Windows allow remote FTP servers to execute arbitrary code,
| cause a denial of service (application crash), or obtain sensitive
| information via a crafted directory listing in a reply.

CVE-2009-3272[2]:
| Stack consumption vulnerability in WebKit.dll in WebKit in Apple
| Safari 3.2.3, and possibly other versions before 4.1.2, allows remote
| attackers to cause a denial of service (application crash) via
| JavaScript code that calls eval on a long string composed of A/
| sequences.

CVE-2009-2841[3]:
| WebKit in Apple Safari before 4.0.4 on Mac OS X does not perform the
| expected callbacks for HTML 5 media elements that have external URLs
| for media resources, which allows remote attackers to trigger requests
| to arbitrary web sites via a crafted HTML document, as demonstrated by
| an HTML e-mail message that uses a media element for
| X-Confirm-Reading-To functionality.

CVE-2009-2816[4]:
| The implementation of Cross-Origin Resource Sharing (CORS) in WebKit,
| as used in Apple Safari before 4.0.4 and Google Chrome before
| 3.0.195.33, includes certain custom HTTP headers in the OPTIONS
| request during cross-origin operations with preflight, which makes it
| easier for remote attackers to conduct cross-site request forgery
| (CSRF) attacks via a crafted web page.

CVE-2009-2797[5]:
| The WebKit component in Safari in Apple iPhone OS before 3.1, and
| iPhone OS before 3.1.1 for iPod touch, does not remove usernames and
| passwords from URLs sent in Referer headers, which allows remote
| attackers to obtain sensitive information by reading Referer logs on a
| web server.

Some additional notes:
- CVE-2009-3384 is already fixed in unstable.
- lenny's webkit does not contain the vulnerable code in CVE-2009-2816.
- I was unable to find any patch info for CVE-2009-2841 or
  CVE-2009-2797, so it is unclear whether debian's webkit is affected or
  not (thanks apple...).

If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.

For further information see:

[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3384
    http://security-tracker.debian.org/tracker/CVE-2009-3384
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3272
    http://security-tracker.debian.org/tracker/CVE-2009-3272
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2841
    http://security-tracker.debian.org/tracker/CVE-2009-2841
[4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2816
    http://security-tracker.debian.org/tracker/CVE-2009-2816
[5] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2797
    http://security-tracker.debian.org/tracker/CVE-2009-2797

Message #10 received at 559759@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: 559759@bugs.debian.org

Subject: re: webkit: multiple security issues

Date: Mon, 22 Feb 2010 22:40:06 -0500

version: 1.1.21-1

i've checked all of these issues, and they are all fixed in the latest
version in unstable.  thanks.

mike

Message #15 received at 559759-close@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: 559759-close@bugs.debian.org

Date: Mon, 22 Feb 2010 22:54:41 -0500

Message #20 received at 559759@bugs.debian.org (full text, mbox, reply):

From: Gustavo Noronha Silva <kov@debian.org>

To: Michael Gilbert <michael.s.gilbert@gmail.com>, 559759@bugs.debian.org

Subject: Re: Bug#559759: webkit: multiple security issues

Date: Tue, 23 Feb 2010 11:30:57 -0300

[Message part 1 (text/plain, inline)]

On Mon, 2010-02-22 at 22:40 -0500, Michael Gilbert wrote:
> version: 1.1.21-1
> 
> i've checked all of these issues, and they are all fixed in the latest
> version in unstable.  thanks.

Awesome! Did you take notes of what commits fixed them? Also, I assume
you wanted to mail -done?

Thanks!

-- 
Gustavo Noronha Silva <kov@debian.org>
Debian

[signature.asc (application/pgp-signature, inline)]

Message #25 received at 559759@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: 559759@bugs.debian.org

Subject: Re: Bug#559759: webkit: multiple security issues

Date: Tue, 23 Feb 2010 11:13:27 -0500

On Tue, 23 Feb 2010 11:30:57 -0300, Gustavo Noronha Silva wrote:
> On Mon, 2010-02-22 at 22:40 -0500, Michael Gilbert wrote:
> > version: 1.1.21-1
> > 
> > i've checked all of these issues, and they are all fixed in the latest
> > version in unstable.  thanks.
> 
> Awesome! Did you take notes of what commits fixed them? 

i recorded that in the security tracker [0].  note that CVE-2009-3272 is
still probably open, but it is only a denial-of-service.

> Also, I assume you wanted to mail -done?

yeah, i noticed i forgot the -done and sent another mail shortly after.

mike

Send a report that this bug log contains spam.