KDE's Cascading Style Sheets (CSS) parser incorrectly handled content, forming the value of CSS "style" attribute. A remote attacker could use this flaw to cause a denial of service (konqueror crash). or, potentially execute arbitrary code with the privileges of the user running "konqueror" web browser, if the victim visited a specially-crafted CSS equipped HTML page. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1698 http://support.apple.com/kb/HT3613 Upstream WebKit patch: http://trac.webkit.org/changeset/42081 Reproducer: http://trac.webkit.org/browser/trunk/LayoutTests/fast/css/attr-parsing.html?rev=42081 Expected reproducer output: http://trac.webkit.org/browser/trunk/LayoutTests/fast/css/attr-parsing-expected.txt?rev=42081
This issue affects the versions of kdelibs package, as shipped with Red Hat Enterprise Linux 3, 4, and 5.
This issue has been addressed in following products: Red Hat Enterprise Linux 3 Via RHSA-2009:1128 https://rhn.redhat.com/errata/RHSA-2009-1128.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2009:1127 https://rhn.redhat.com/errata/RHSA-2009-1127.html
This also affects kdelibs3 3.5.10 in Fedora. I was unable to verify whether kdelibs 4.2.4 is affected too because the code is significantly different.
(Note that if KDE 4 is still affected, then this is NOT fixed in KDE trunk. The WebKit patch and the KDE 3 patch are very different from each other, and in both cases the patched code is very different from the KDE 4 code.)
For QtWebKit, this is fixed in Qt 4.5.2 which got pushed to Fedora updates recently. I didn't check earlier versions.
The reproducer also reports FAILURE in KDE 4.2.4's Konqueror. Looks like this is still unfixed in KDE 4.
Looks like I can port the KDE 3 fix.
Created attachment 355171 [details] Untested patch against kdelibs 4.2.98 Here's an untested patch against kdelibs 4.2.98.
kdelibs-4.2.4-6.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/kdelibs-4.2.4-6.fc11
kdelibs-4.2.4-6.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/kdelibs-4.2.4-6.fc10
kdelibs3-3.5.10-13.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/kdelibs3-3.5.10-13.fc11
kdelibs3-3.5.10-13.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/kdelibs3-3.5.10-13.fc10
kdelibs-4.2.4-6.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
kdelibs-4.2.4-6.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
kdelibs3-3.5.10-13.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
kdelibs3-3.5.10-13.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.