The Google Chrome 3.24.35.10 release[1] fixed a number of vulnerabilities in v8: 343964 https://codereview.chromium.org/170343003 https://code.google.com/p/chromium/issues/detail?id=343964 344186 https://codereview.chromium.org/172093002 https://code.google.com/p/chromium/issues/detail?id=344186 347909 https://codereview.chromium.org/184393002 https://code.google.com/p/chromium/issues/detail?id=347909 From an initial inspection, these all require untrusted JavaScript to be parsed to trigger the issues. As such, these should have a moderate or low impact for the way v8 is used in Red Hat products. [1] http://googlechromereleases.blogspot.com.au/2014/03/stable-channel-update.html
Created v8 tracking bugs for this issue: Affects: fedora-all [bug 1074739] Affects: epel-6 [bug 1074740]
(In reply to Murray McAllister from comment #0) > The Google Chrome 3.24.35.10 release[1] fixed a number of vulnerabilities in > v8: > > 343964 > https://codereview.chromium.org/170343003 This patch touches a number of functions that do not exist in v8 3.14. > 344186 > https://codereview.chromium.org/172093002 This patch is to a file that does not exist in v8 3.14. > 347909 > https://codereview.chromium.org/184393002 This patch also seems to be for code that does not exist in our v8.
(In reply to T.C. Hollingsworth from comment #3) > > 344186 > > https://codereview.chromium.org/172093002 > > This patch is to a file that does not exist in v8 3.14. In v8 3.14, BoundsCheckBbData is in src/hydrogen.cc. Upstream test case for this bug also crashes 3.14.
Note there is an additional follow-up fix for the code modified by the commit mentioned in comment 4 under CVE-2014-1729, see bug 1086120 comment 2.
(In reply to Tomas Hoger from comment #4) > (In reply to T.C. Hollingsworth from comment #3) > > > 344186 > > > https://codereview.chromium.org/172093002 > > > > This patch is to a file that does not exist in v8 3.14. > > In v8 3.14, BoundsCheckBbData is in src/hydrogen.cc. Upstream test case for > this bug also crashes 3.14. Backport of the fix to v8 bundled with node.js 0.10: https://github.com/joyent/node/commit/fd80a31e0697d6317ce8c2d289575399f4e06d21 released as part of node.js 0.10.31: http://blog.nodejs.org/2014/08/19/node-v0-10-31-stable/
(In reply to Tomas Hoger from comment #6) > Backport of the fix to v8 bundled with node.js 0.10: > > https://github.com/joyent/node/commit/ > fd80a31e0697d6317ce8c2d289575399f4e06d21 > > released as part of node.js 0.10.31: > > http://blog.nodejs.org/2014/08/19/node-v0-10-31-stable/ Please make sure you also pull in: https://github.com/joyent/node/commit/3122e0eae64c5ab494b29d0a9cadef902d93f1f9 Otherwise lots of applications will segfault: https://github.com/joyent/node/issues/8208
nodejs-0.10.32-1.fc21, v8-3.14.5.10-14.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
nodejs-0.10.32-1.fc19, v8-3.14.5.10-14.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
nodejs-0.10.32-1.fc20, v8-3.14.5.10-14.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Statement: Red Hat Product Security has rated this issue as having Low security impact in Red Hat Enterprise Linux OpenStack Platform. This issue is not currently planned to be addressed in a future security update.
This issue has been addressed in the following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Via RHSA-2014:1744 https://rhn.redhat.com/errata/RHSA-2014-1744.html
nodejs-0.10.32-1.el7, v8-3.14.5.10-14.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
nodejs-0.10.32-1.el6, v8-3.14.5.10-14.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.