Bug 1186234 (CVE-2014-1292)

Summary: CVE-2014-1292 webkitgtk: arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fedora, huzaifas, kalevlember, kevin, martin.sourada, mcatanzaro+wrong-account-do-not-cc, mclasen, mtasaka, tpopela
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: WebKitGTK+ 2.4.1, 2.4.2 and 2.4.8 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-31 05:23:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1181092, 1186276    
Bug Blocks: 1186188    

Description Vasyl Kaigorodov 2015-01-27 10:35:20 UTC 
Following vulnerability was discovered on the 2.4 stable series of WebKitGTK+:

CVE-2014-1292
 WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294

External References:

http://webkitgtk.org/security/WSA-2015-0001.html
Comment 1 Vasyl Kaigorodov 2015-01-27 10:50:04 UTC 
Created webkitgtk4 tracking bugs for this issue:

Affects: fedora-all [bug 1186276]
Comment 2 Vasyl Kaigorodov 2015-01-27 10:50:05 UTC 
Created webkitgtk3 tracking bugs for this issue:

Affects: fedora-all [bug 1181092]
Comment 4 Huzaifa S. Sidhpurwala 2015-07-31 05:33:51 UTC 
Statement:

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.