Summary: | <net-libs/webkit-gtk-2.18.1: multiple vulnerabilities | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | D'juan McDonald (domhnall) <flopwiki> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | gnome |
Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://www.webkitgtk.org/security/WSA-2017-0008.html | ||
Whiteboard: | B3 [noglsa cve] | ||
Package list: |
net-libs/webkit-gtk-2.18.2
|
Runtime testing required: | Yes |
Bug Depends on: | 635144 | ||
Bug Blocks: |
CVE-2017-7127 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7127): An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. iCloud before 7.0 on Windows is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "SQLite" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. CVE-2017-7120 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7120): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7117 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7117): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7111 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7111): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7109 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7109): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via crafted web content that incorrectly interacts with the Application Cache policy. CVE-2017-7107 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7107): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7106 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7106): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof the address bar. CVE-2017-7104 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7104): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7102 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7102): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7100 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7100): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7099 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7099): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7098 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7098): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7096 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7096): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7095 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7095): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7094 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7094): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7093 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7093): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7092 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7092): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7091 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7091): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7090 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7090): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive cookie information via a custom URL scheme. CVE-2017-7089 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7089): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that is mishandled during parent-tab processing. CVE-2017-7087 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7087): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7081 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7081): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. CVE-2017-7144 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7144): An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to track Safari Private Browsing users by leveraging cookie mishandling. CVE-2017-7142 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7142): An issue was discovered in certain Apple products. Safari before 11 is affected. The issue involves the "WebKit Storage" component. It allows attackers to bypass the Safari Private Browsing protection mechanism, and consequently obtain sensitive information about visited web sites. We should be able to proceed now. It would be good if a casual runtime check with stable epiphany (2.22.x) is done on one of the architectures. E.g just a youtube video, maybe gmail login. Temporarily withdrawing stabilization. 2.18.2 was released, which seems to have rather important regression fixes. I will try to bump and request stabilization of it before end of weekend for fixing these security issues referenced here. amd64 stable x86 stable @ Maintainer(s): Please cleanup! The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=71049fe1e3a508e5fa82b7716e00cbbde8fd3d37 commit 71049fe1e3a508e5fa82b7716e00cbbde8fd3d37 Author: Mart Raudsepp <leio@gentoo.org> AuthorDate: 2017-10-29 22:11:17 +0000 Commit: Mart Raudsepp <leio@gentoo.org> CommitDate: 2017-10-29 22:11:17 +0000 net-libs/webkit-gtk: security cleanup Bug: https://bugs.gentoo.org/635134 Package-Manager: Portage-2.3.8, Repoman-2.3.2 net-libs/webkit-gtk/Manifest | 2 - .../files/webkit-gtk-2.8.5-fix-alpha-build.patch | 22 -- net-libs/webkit-gtk/webkit-gtk-2.16.6.ebuild | 288 --------------------- net-libs/webkit-gtk/webkit-gtk-2.18.1.ebuild | 284 -------------------- 4 files changed, 596 deletions(-)} cleanup done. As usual, SLOT=2 and SLOT=3 versions remain, which is tracked in an old security bug. GLSA Vote: No Thanks, Leio! |
See {URL}: @maintainer(s), commit 3f020256 is already in tree. Call for stabilization when ready. > net-libs/webkit-gtk: bump to 2.18.1 for security; other package touchups. > Mart Raudsepp, Sun, 22 Oct 2017 17:59 Gentoo Security Padawan Daj Uan (jmbailey)