20b7bbefae
Sun Jul 26 2009 Kevin Kofler <Kevin@tigcc.ticalc.org> - 3.5.10-13
- fix CVE-2009-2537 - select length DoS
- fix CVE-2009-1725 - crash, possible ACE in numeric character references
- fix CVE-2009-1690 - crash, possible ACE in KHTML (<head> use-after-free)
- fix CVE-2009-1687 - possible ACE in KJS (FIXME: still crashes?)
- fix CVE-2009-1698 - crash, possible ACE in CSS style attribute handling
Fri Jul 24 2009 Fedora Release Engineering
<rel-eng@lists.fedoraproject.org> - 3.5.10-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
Sat Jul 18 2009 Rex Dieter <rdieter@fedoraproject.org> - 3.5.10-12
- FTBFS kdelibs3-3.5.10-11.fc11 (#511571)
- -devel: Requires: %%{name}%%_isa ...
Sun Apr 19 2009 Rex Dieter <rdieter@fedoraproject.org> - 3.5.10-11
- update openssl patch (for 0.9.8k)
Thu Apr 16 2009 Rex Dieter <rdieter@fedoraproject.org> - 3.5.10-10
- move designer plugins to runtime (#487622)
- make -apidocs noarch
Mon Mar 02 2009 Than Ngo <than@redhat.com> - 3.5.10-9
- enable -apidocs
Fri Feb 27 2009 Rex Dieter <rdieter@fedoraproject.org> - 3.5.10-8
- disable -apidocs (f11+, #487719)
- cleanup unused kdeui_symlink hack baggage
Wed Feb 25 2009 Than Ngo <than@redhat.com> - 3.5.10-7
- fix files conflicts with 4.2.x
- fix build issue with gcc-4.4
Wed Feb 25 2009 Fedora Release Engineering
<rel-eng@lists.fedoraproject.org> - 3.5.10-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
3.5.10-5
- unowned dirs (#483318)
3.5.10-4
- Slight speedup to profile.d/kde.sh (#465370).
31 lines
1.6 KiB
Diff
31 lines
1.6 KiB
Diff
diff -ur kdelibs-3.5.10/khtml/ecma/kjs_html.cpp kdelibs-3.5.10-cve-2009-2537-select-length/khtml/ecma/kjs_html.cpp
|
|
--- kdelibs-3.5.10/khtml/ecma/kjs_html.cpp 2008-02-13 10:41:09.000000000 +0100
|
|
+++ kdelibs-3.5.10-cve-2009-2537-select-length/khtml/ecma/kjs_html.cpp 2009-07-26 04:54:52.000000000 +0200
|
|
@@ -62,6 +62,9 @@
|
|
|
|
#include <kdebug.h>
|
|
|
|
+// CVE-2009-2537 (vendors agreed on max 10000 elements)
|
|
+#define MAX_SELECT_LENGTH 10000
|
|
+
|
|
namespace KJS {
|
|
|
|
KJS_DEFINE_PROTOTYPE_WITH_PROTOTYPE(HTMLDocumentProto, DOMDocumentProto)
|
|
@@ -2550,8 +2553,14 @@
|
|
case SelectValue: { select.setValue(str); return; }
|
|
case SelectLength: { // read-only according to the NS spec, but webpages need it writeable
|
|
Object coll = Object::dynamicCast( getSelectHTMLCollection(exec, select.options(), select) );
|
|
- if ( coll.isValid() )
|
|
- coll.put(exec,"length",value);
|
|
+
|
|
+ if ( coll.isValid() ) {
|
|
+ if (value.toInteger(exec) >= MAX_SELECT_LENGTH) {
|
|
+ Object err = Error::create(exec, RangeError);
|
|
+ exec->setException(err);
|
|
+ } else
|
|
+ coll.put(exec, "length", value);
|
|
+ }
|
|
return;
|
|
}
|
|
// read-only: form
|