A security flaw was found in the WebKit's Cross-Origin Resource Sharing (CORS) implementation. Quoting exact details from the WebKit advisory: Before allowing a page from one origin to access a resource in another origin, WebKit sends a preflight request, to determine if the origin server for the resource being accessed will allow the resource to be shared. WebKit includes custom HTTP headers specified by the requesting page in the preflight request. This can result in unexpected actions being initiated on the cross-origin site without user consent. This issue is addressed by dropping custom HTTP headers from preflight requests. Upstream bug: ------------- https://bugs.webkit.org/show_bug.cgi?id=28446 Upstream patch: --------------- http://trac.webkit.org/changeset/47494
This issue affects latest versions of WebKit package, as shipped with Fedora release of 10 and 11 (WebKit-1.1.0-0.16.svn40351.fc10 and WebKit-1.1.1-1.fc11). This issue affects latest versions of qt package, as shipped with Fedora release of 10 and 11 (qt-4.5.2-3.fc10 and qt-4.5.2-3.fc11).
Public now via: http://threatpost.com/en_us/blogs/apple-patches-critical-safari-vulnerabilities-111109
qt-4.5.3-9.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/qt-4.5.3-9.fc12
qt-4.5.3-9.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
qt-4.5.3-9.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
qt-4.5.3-9.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.