Bug 1165652 – CVE-2014-7904 chromium-browser: Buffer overflow in Skia

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1165652 - (CVE-2014-7904) CVE-2014-7904 chromium-browser: Buffer overflow in Skia

Summary:	CVE-2014-7904 chromium-browser: Buffer overflow in Skia

Status:	CLOSED WONTFIX

Aliases:	CVE-2014-7904

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20141118,repor...
Keywords:	Reopened, Security

Depends On:	1165942 1165943
Blocks:	1165665 1167618
	Show dependency tree / graph

Reported:	2014-11-19 07:40 EST by Vasyl Kaigorodov
Modified:	2015-11-25 05:20 EST (History)
CC List:	2 users (show)

See Also:
Fixed In Version:	Chrome 39.0.2171.65
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-09-04 02:37:24 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:1894	normal	SHIPPED_LIVE	Important: chromium-browser security update	2014-11-24 20:56:55 EST

Groups: None (edit)

Description Vasyl Kaigorodov 2014-11-19 07:40:56 EST

Unspecified buffer overflow vulnerability was found [1] in Skia (2D graphics engine used in Chromium).

[1]: https://code.google.com/p/chromium/issues/detail?id=418161

External References:

http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html

Comment 2 Huzaifa S. Sidhpurwala 2014-11-20 00:32:14 EST

Upstream commit:

https://skia.googlesource.com/skia.git/+/3a49520696b2eca69e57884657d23fd2402ccfd1

Comment 3 errata-xmlrpc 2014-11-24 15:57:21 EST

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:1894 https://rhn.redhat.com/errata/RHSA-2014-1894.html

Comment 4 Huzaifa S. Sidhpurwala 2015-09-04 02:10:58 EDT

Upstream librsvg2 patch at:

https://git.gnome.org/browse/librsvg/commit/?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df

Comment 5 Huzaifa S. Sidhpurwala 2015-09-04 02:30:13 EDT

Statement:

This issue did not affect the versions of librsvg2 as shipped with Red Hat Enterprise Linux 5 and 6. This issue affects the version of librsvg2 as shipped with Red Hat Enterprise Linux 7.

Note You need to log in before you can comment on or make changes to this bug.