Bug 924495 (CVE-2013-2632)

Summary:	CVE-2013-2632 v8: remote DoS via crafted javascript
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	sgallagh, tcallawa, tchollingsworth, tomspur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-06-27 13:48:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	924496, 924497
Bug Blocks:

Description Vincent Danen 2013-03-21 21:51:45 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-2632 to
the following vulnerability:

Name: CVE-2013-2632
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2632
Assigned: 20130321
Reference: http://code.google.com/p/v8/source/browse/trunk/ChangeLog
Reference: http://googlechromereleases.blogspot.com/2013/03/dev-channel-update_18.html
Reference: https://code.google.com/p/chromium/issues/detail?id=194749

Google V8 before 3.17.13, as used in Google Chrome before 27.0.1444.3,
allows remote attackers to cause a denial of service (application
crash) or possibly have unspecified other impact via crafted
JavaScript code, as demonstrated by the Bejeweled game.

Comment 1 Vincent Danen 2013-03-21 21:52:59 UTC

Created v8 tracking bugs for this issue

Affects: fedora-all [bug 924496]
Affects: epel-6 [bug 924497]

Comment 2 T.C. Hollingsworth 2013-03-22 00:25:34 UTC

Node.js upstream has been notified:
https://github.com/joyent/node/issues/5113

I'll be backporting this to Fedora's V8 shortly.

Comment 3 Fedora Update System 2013-04-05 23:03:05 UTC

v8-3.14.5.8-1.fc18, nodejs-0.10.2-1.fc18, libuv-0.10.3-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2013-04-11 17:09:19 UTC

v8-3.14.5.8-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.