Bug 1039887 (CVE-2013-6638) - CVE-2013-6638 v8: multiple buffer overflows in runtime.cc
Summary: CVE-2013-6638 v8: multiple buffer overflows in runtime.cc
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2013-6638
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1039892 1039893
Blocks: Embargoed1040074
TreeView+ depends on / blocked
 
Reported: 2013-12-10 09:20 UTC by Ratul Gupta
Modified: 2021-02-17 07:04 UTC (History)
54 users (show)

Fixed In Version: v8 3.22.24.7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-12-11 06:19:20 UTC

Attachments (Terms of Use)

Description Ratul Gupta 2013-12-10 09:20:03 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-6638 to the following vulnerability:

Name: CVE-2013-6638
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6638
Assigned: 20131105
Reference: http://www.mail-archive.com/v8-dev@googlegroups.com/msg79646.html
Reference: http://code.google.com/p/v8/source/detail?r=17800
Reference: http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html
Reference: https://code.google.com/p/chromium/issues/detail?id=319722

Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large typed array, related to the (1) Runtime_TypedArrayInitialize and (2) Runtime_TypedArrayInitializeFromArrayLike functions.
Comment 1 Ratul Gupta 2013-12-10 09:24:57 UTC 
Created v8 tracking bugs for this issue:

Affects: fedora-all [bug 1039892]
Affects: epel-6 [bug 1039893]
Comment 2 T.C. Hollingsworth 2013-12-10 15:53:43 UTC 
This does not appear to affect v8-3.14.5.10 stable version used by Fedora for node.js.  The TypedArray class affected does not exist in this version.
Comment 3 Garth Mollett 2013-12-11 04:11:17 UTC 
(In reply to T.C. Hollingsworth from comment #2)
> This does not appear to affect v8-3.14.5.10 stable version used by Fedora
> for node.js.  The TypedArray class affected does not exist in this version.

Same appears to be true for the ruby193-v8 versions as shipped by openstack,openshift,cloudforms, satellite and sam.
Comment 4 Garth Mollett 2013-12-11 06:19:20 UTC 
Statement:

Not Vulnerable. This issue only affects versions of v8 that support typed arrays. This issue does not affect the versions of v8 as shipped with various Red Hat products.
Note You need to log in before you can comment on or make changes to this bug.