Bug 845252 – <net-libs/webkit-gtk-2.36.3: Multiple vulnerabilities

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2022-05-18 03:17:43 UTC]

2.36.2 mentions "- Fix several crashes and rendering issues." which is almost always "a bunch of CVEs but we don't want to say that yet".

Thanks!

[Comment 1 Larry the Git Cow 2022-05-18 16:27:07 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=169adc81f429529590c778c8f923663ae547f7af

commit 169adc81f429529590c778c8f923663ae547f7af
Author:     Matt Turner <[e-mail]>
AuthorDate: 2022-05-18 16:23:39 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2022-05-18 16:26:59 +0000

    net-libs/webkit-gtk: Version bump to 2.36.2
    
    * Raise gst dependency to >=1.20 (bug #843950)
    
    Bug: https://bugs.gentoo.org/845252
    Closes: https://bugs.gentoo.org/843950
    Signed-off-by: Matt Turner <[e-mail]>

 net-libs/webkit-gtk/Manifest                 |   1 +
 net-libs/webkit-gtk/webkit-gtk-2.36.2.ebuild | 250 +++++++++++++++++++++++++++
 2 files changed, 251 insertions(+)

[Comment 2 John Helmert III 2022-05-18 17:05:59 UTC]

(In reply to Sam James from comment #0)
> 2.36.2 mentions "- Fix several crashes and rendering issues." which is
> almost always "a bunch of CVEs but we don't want to say that yet".
> 
> Thanks!

This also comes two days after a Safari advisory: https://support.apple.com/en-us/HT213260

Interestingly, that page has WebKit Bugzilla bug IDs, some of which are public.

[Comment 3 Larry the Git Cow 2022-05-29 01:17:18 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=86cf7dde6f6cc1fdde18de42b2f66e7886c2e35e

commit 86cf7dde6f6cc1fdde18de42b2f66e7886c2e35e
Author:     Matt Turner <[e-mail]>
AuthorDate: 2022-05-29 01:16:08 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2022-05-29 01:17:11 +0000

    net-libs/webkit-gtk: Version bump to 2.36.3
    
    Bug: https://bugs.gentoo.org/845252
    Signed-off-by: Matt Turner <[e-mail]>

 net-libs/webkit-gtk/Manifest                 |   1 +
 net-libs/webkit-gtk/webkit-gtk-2.36.3.ebuild | 250 +++++++++++++++++++++++++++
 2 files changed, 251 insertions(+)

[Comment 4 John Helmert III 2022-06-14 17:28:23 UTC]

Thanks, Matt!

[Comment 5 Larry the Git Cow 2022-06-29 19:25:18 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3eeb7feb045225c1cb5340d78746fd5718f2b064

commit 3eeb7feb045225c1cb5340d78746fd5718f2b064
Author:     Matt Turner <[e-mail]>
AuthorDate: 2022-06-29 19:24:34 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2022-06-29 19:25:08 +0000

    net-libs/webkit-gtk: Drop old versions
    
    Bug: https://bugs.gentoo.org/845252
    Signed-off-by: Matt Turner <[e-mail]>

 net-libs/webkit-gtk/Manifest                 |   1 -
 net-libs/webkit-gtk/webkit-gtk-2.36.1.ebuild | 250 ---------------------------
 2 files changed, 251 deletions(-)

[Comment 6 Larry the Git Cow 2022-08-31 23:57:13 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=1d278bb93fbf8fdb34ef9c125c5f4536e11c15d7

commit 1d278bb93fbf8fdb34ef9c125c5f4536e11c15d7
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-31 23:54:04 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-31 23:56:59 +0000

    [ GLSA 202208-39 ] WebKitGTK+: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/832990
    Bug: https://bugs.gentoo.org/833568
    Bug: https://bugs.gentoo.org/837305
    Bug: https://bugs.gentoo.org/839984
    Bug: https://bugs.gentoo.org/845252
    Bug: https://bugs.gentoo.org/856445
    Bug: https://bugs.gentoo.org/861740
    Bug: https://bugs.gentoo.org/864427
    Bug: https://bugs.gentoo.org/866494
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-39.xml | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)