Bug 709612 – <net-libs/webkit-gtk-2.26.4: multiple vulnerabilities

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2020-02-14 14:25:31 UTC]

From https://www.openwall.com/lists/oss-security/2020/02/14/6 :

------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory                 WSA-2020-0002
------------------------------------------------------------------------

Date reported           : February 14, 2020
Advisory ID             : WSA-2020-0002
WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2020-0002.html
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2020-0002.html
CVE identifiers         : CVE-2020-3862, CVE-2020-3864, CVE-2020-3865,
                          CVE-2020-3867, CVE-2020-3868.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2020-3862
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to Srikanth Gatta of Google Chrome.
    Impact: A malicious website may be able to cause a denial of
    service. Description: A denial of service issue was addressed with
    improved memory handling.

CVE-2020-3864
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to Ryan Pickren (ryanpickren.com).
    Impact: A DOM object context may not have had a unique security
    origin. Description: A logic issue was addressed with improved
    validation.

CVE-2020-3865
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to Ryan Pickren (ryanpickren.com).
    Impact: A top-level DOM object context may have incorrectly been
    considered secure. Description: A logic issue was addressed with
    improved validation.

CVE-2020-3867
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to an anonymous researcher.
    Impact: Processing maliciously crafted web content may lead to
    universal cross site scripting. Description: A logic issue was
    addressed with improved state management.

CVE-2020-3868
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to Marcin Towalski of Cisco Talos.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: Multiple memory corruption
    issues were addressed with improved memory handling.


We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.

The WebKitGTK and WPE WebKit team,
February 14, 2020


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Larry the Git Cow 2020-02-14 22:15:51 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fb2dcb0fecee802258e1501ef657f6de2a4c99a0

commit fb2dcb0fecee802258e1501ef657f6de2a4c99a0
Author:     Mart Raudsepp <[e-mail]>
AuthorDate: 2020-02-14 22:14:37 +0000
Commit:     Mart Raudsepp <[e-mail]>
CommitDate: 2020-02-14 22:14:54 +0000

    net-libs/webkit-gtk: security bump to 2.26.4
    
    -r0 is for fast security stabling, -r1 is the enchant:2 ensuring
    revision.
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <[e-mail]>

 net-libs/webkit-gtk/Manifest                    |   1 +
 net-libs/webkit-gtk/webkit-gtk-2.26.4-r1.ebuild | 286 ++++++++++++++++++++++++
 net-libs/webkit-gtk/webkit-gtk-2.26.4.ebuild    | 286 ++++++++++++++++++++++++
 3 files changed, 573 insertions(+)

[Comment 2 Mikle Kolyada (RETIRED) 2020-02-15 12:20:49 UTC]

amd64 stable

[Comment 3 Thomas Deutschmann (RETIRED) 2020-02-16 21:16:40 UTC]

x86 stable

[Comment 4 Larry the Git Cow 2020-02-17 21:54:01 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0f61be8a83c5fb4c088d60a8bf0acaaa27ac3bb

commit a0f61be8a83c5fb4c088d60a8bf0acaaa27ac3bb
Author:     Mart Raudsepp <[e-mail]>
AuthorDate: 2020-02-17 21:38:08 +0000
Commit:     Mart Raudsepp <[e-mail]>
CommitDate: 2020-02-17 21:53:22 +0000

    net-libs/webkit-gtk: security cleanup
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <[e-mail]>

 net-libs/webkit-gtk/Manifest                       |   1 -
 .../files/2.26.3-fix-noGL-wayland-build.patch      |  39 ---
 net-libs/webkit-gtk/webkit-gtk-2.26.3-r1.ebuild    | 287 ---------------------
 net-libs/webkit-gtk/webkit-gtk-2.26.3.ebuild       | 287 ---------------------
 4 files changed, 614 deletions(-)

[Comment 5 Ovidiu - Dan Bogat 2020-03-03 09:59:01 UTC]

There is a new CVE within this version which has been fixed upstream/trunk (commited), but is not yet in the source package.  


CVE-2020-10018 
accessibility/AXObjectCache.cpp in WebKit, as used in WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4, allows a denial of service (application crash) because maintenance of the m_deferredFocusedNodeChange data structure mishandles removal.

https://bugs.webkit.org/show_bug.cgi?id=204342
https://trac.webkit.org/changeset/25729

The bug details are restricted even with an account (at least for me).

[Comment 6 Ovidiu - Dan Bogat 2020-03-03 10:02:59 UTC]

CVE-2020-10018 changeset https://trac.webkit.org/changeset/257292

[Comment 7 Mart Raudsepp 2020-03-12 14:45:59 UTC]

If 2.26.4 doesn't cover it, then file a new bug, this one as part of this security bug has already been handled on most arches.

[Comment 8 Sam James 2020-03-12 18:00:30 UTC]

(In reply to Mart Raudsepp from comment #7)
> If 2.26.4 doesn't cover it, then file a new bug, this one as part of this
> security bug has already been handled on most arches.

It doesn't: reported as bug 712260

[Comment 9 Larry the Git Cow 2020-03-12 20:08:11 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=35abfda017fa69012bb8f7c768ed24d9b343c281

commit 35abfda017fa69012bb8f7c768ed24d9b343c281
Author:     Mart Raudsepp <[e-mail]>
AuthorDate: 2020-03-12 20:08:03 +0000
Commit:     Mart Raudsepp <[e-mail]>
CommitDate: 2020-03-12 20:08:03 +0000

    net-libs/webkit-gtk: security cleanup to the extent possible
    
    Vulnerable versions only in ~arch versions now due to lack of
    movement on many architectures on re-keywording
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <[e-mail]>

 net-libs/webkit-gtk/webkit-gtk-2.24.4.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[Comment 10 Mart Raudsepp 2020-03-12 20:09:07 UTC]

arm64 stable. Cleanup can't be done further due to bug 704182

[Comment 11 Thomas Deutschmann (RETIRED) 2020-03-15 04:35:14 UTC]

New GLSA request filed.

[Comment 12 GLSAMaker/CVETool Bot 2020-03-15 04:44:55 UTC]

This issue was resolved and addressed in
 GLSA 202003-22 at https://security.gentoo.org/glsa/202003-22
by GLSA coordinator Thomas Deutschmann (whissi).