A use after free issue exists in WebKit's handling of geolocation events. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handing of geolocation events. References: Bugzilla: https://bugs.webkit.org/show_bug.cgi?id=39388 Trac: http://trac.webkit.org/changeset/59859 Acknowledgements: Red Hat would like to thank Drew Yao of Apple Product Security for responsibly reporting this issue. Upstream acknowledges Justin Schuh as the original reporter.
Upstream indicates this is a regression probably caused here (via https://bugs.webkit.org/show_bug.cgi?id=37815#c60): "Reverted r59693 for reason: Broke GTK Release Committed r59727: <http://trac.webkit.org/changeset/59727>" It looks like webkitgtk 1.2.0 is using r56916 based on the ChangeLog entries. If that is the case, then this would not affect webkitgtk (as we provide it) at all.
Geolocation is not supported by Konqueror.
This is being made public now, we've been given the go-ahead from upstream to do so.
Created webkitgtk tracking bugs for this issue Affects: fedora-all [bug 606304]
Created qt tracking bugs for this issue Affects: fedora-all [bug 538236]
qt-4.6.3-8.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
qt-4.6.3-8.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.