Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2009-1686

Published: 10 June 2009

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle constant (aka const) declarations in a type-conversion operation during JavaScript exception handling, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.

Notes

AuthorNote
jdstrand
webkit is a fork of khtml from kdelibs. kdelibs5 is farther from
it, while qt4-x11 attempts to unify khtml and webkit
mdeslaur
code doesn't seem present in kde4libs
code not present in webkit in intrepid+
code is different in hardy, need to check with test case
in qt4-x11, code doesn't seem present

Priority

Medium

Status

Package Release Status
qt4-x11
Launchpad, Ubuntu, Debian
dapper Not vulnerable
(no webkit)
hardy Not vulnerable
(no webkit)
intrepid Not vulnerable
(code not present)
jaunty Not vulnerable
(code not present)
karmic Not vulnerable
(code not present)
lucid Not vulnerable
(code not present)
maverick Not vulnerable
(code not present)
natty Not vulnerable
(code not present)
upstream Needs triage

webkit
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy Ignored
(end of life)
intrepid Not vulnerable
(1.0.1-2ubuntu0.1)
jaunty Not vulnerable
(1.0.1-4)
karmic Not vulnerable
(1.1.12-1ubuntu1)
lucid Not vulnerable
(1.1.12-1ubuntu1)
maverick Not vulnerable
(1.1.12-1ubuntu1)
natty Not vulnerable
(1.1.12-1ubuntu1)
upstream Needs triage

Patches:
upstream: http://trac.webkit.org/changeset/31431