------------------------------------------------------------------------
Pardus Linux Security Advisory 2009-187           security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2009-11-19
  Severity: 3
      Type: Remote
------------------------------------------------------------------------

Summary
======
Multiple vulnerabilities were found in Webkit, which can be exploited by
malicious people to cause denial of service or potentially to execution
of arbitrary code.

Description
==========
* CVE-2009-3384:
Multiple security flaws (integer underflow, invalid pointer dereference,
buffer underflow and a denial of service) were found in the way WebKit's
FTP parser used to process remote FTP directory listings. If  a  remote
FTP server issued a specially-crafted FTP command,  it  could  lead  to
disclosure of sensitive information,  denial  of  service  (application
crash) or, potentially to execution of arbitrary code, once the command
was parsed.

* CVE-2009-2816:
Before allowing a page from one origin to access a resource in  another
origin, WebKit sends a preflight request, to determine  if  the  origin
server for the resource being accessed will allow the  resource  to  be
shared. WebKit includes custom HTTP headers specified by the requesting
page in the preflight request. This can result  in  unexpected  actions
being initiated on the cross-origin site  without  user  consent.  This
issue is addressed by  dropping  custom  HTTP  headers  from  preflight
requests.


Affected packages:

  Pardus 2009:
    qt, all before 4.5.3-72-16


Resolution
=========
There are update(s) for qt. You can update them via Package Manager  or
with a single command from console:

    pisi up qt

References
=========
  * http://bugs.pardus.org.tr/show_bug.cgi?id546
  * http://bugs.pardus.org.tr/show_bug.cgi?id545
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3384
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2816
  * https://bugs.webkit.org/show_bug.cgi?id(446
  * https://bugs.webkit.org/show_bug.cgi?id)294