Red Hat Bugzilla – Bug 1094858
CVE-2014-1736 v8: integer overflow can lead to a remote denial of service
Last modified: 2016-04-26 20:47:37 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-1736 to the following vulnerability: Name: CVE-2014-1736 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1736 Assigned: 20140129 Reference: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html Reference: https://code.google.com/p/chromium/issues/detail?id=359802 Reference: https://code.google.com/p/v8/source/detail?r=20519 Reference: https://code.google.com/p/v8/source/detail?r=20525 Reference: SECUNIA:58301 Reference: http://secunia.com/advisories/58301 Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value. A quick examination of the code in Fedora shows that it is likely affected although the upstream patches would require some massaging to apply.
Created v8 tracking bugs for this issue: Affects: fedora-all [bug 1094892] Affects: epel-6 [bug 1094893]
(In reply to Vincent Danen from comment #0) > https://code.google.com/p/v8/source/detail?r=20519 This commit was later reverted as incorrect, see: https://code.google.com/p/v8/source/detail?r=20520 > https://code.google.com/p/v8/source/detail?r=20525 This is not applicable to v8 3.14.