Bug 709612 (CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, WSA-2020-0002)

Summary:	<net-libs/webkit-gtk-2.26.4: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	gnome, ovi
Priority:	Normal	Flags:	stable-bot: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	A3 [glsa+ cve]
Package list:	gui-libs/libwpe-1.4.0.1 gui-libs/wpebackend-fdo-1.4.0 sys-apps/xdg-dbus-proxy-0.1.2 net-libs/webkit-gtk-2.26.4	Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2020-02-14 14:25:31 UTC

From https://www.openwall.com/lists/oss-security/2020/02/14/6 :

------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory WSA-2020-0002
------------------------------------------------------------------------

Date reported : February 14, 2020
Advisory ID : WSA-2020-0002
WebKitGTK Advisory URL : https://webkitgtk.org/security/WSA-2020-0002.html
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2020-0002.html
CVE identifiers : CVE-2020-3862, CVE-2020-3864, CVE-2020-3865,
CVE-2020-3867, CVE-2020-3868.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2020-3862
Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
2.26.4.
Credit to Srikanth Gatta of Google Chrome.
Impact: A malicious website may be able to cause a denial of
service. Description: A denial of service issue was addressed with
improved memory handling.

CVE-2020-3864
Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
2.26.4.
Credit to Ryan Pickren (ryanpickren.com).
Impact: A DOM object context may not have had a unique security
origin. Description: A logic issue was addressed with improved
validation.

CVE-2020-3865
Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
2.26.4.
Credit to Ryan Pickren (ryanpickren.com).
Impact: A top-level DOM object context may have incorrectly been
considered secure. Description: A logic issue was addressed with
improved validation.

CVE-2020-3867
Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
2.26.4.
Credit to an anonymous researcher.
Impact: Processing maliciously crafted web content may lead to
universal cross site scripting. Description: A logic issue was
addressed with improved state management.

CVE-2020-3868
Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
2.26.4.
Credit to Marcin Towalski of Cisco Talos.
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Description: Multiple memory corruption
issues were addressed with improved memory handling.

We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.

The WebKitGTK and WPE WebKit team,
February 14, 2020

@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 Larry the Git Cow gentoo-dev

2020-02-14 22:15:51 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fb2dcb0fecee802258e1501ef657f6de2a4c99a0

commit fb2dcb0fecee802258e1501ef657f6de2a4c99a0
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2020-02-14 22:14:37 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2020-02-14 22:14:54 +0000

    net-libs/webkit-gtk: security bump to 2.26.4
    
    -r0 is for fast security stabling, -r1 is the enchant:2 ensuring
    revision.
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <leio@gentoo.org>

 net-libs/webkit-gtk/Manifest                    |   1 +
 net-libs/webkit-gtk/webkit-gtk-2.26.4-r1.ebuild | 286 ++++++++++++++++++++++++
 net-libs/webkit-gtk/webkit-gtk-2.26.4.ebuild    | 286 ++++++++++++++++++++++++
 3 files changed, 573 insertions(+)

Comment 2 Mikle Kolyada (RETIRED) archtester

2020-02-15 12:20:49 UTC

amd64 stable

Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev

2020-02-16 21:16:40 UTC

x86 stable

Comment 4 Larry the Git Cow gentoo-dev

2020-02-17 21:54:01 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0f61be8a83c5fb4c088d60a8bf0acaaa27ac3bb

commit a0f61be8a83c5fb4c088d60a8bf0acaaa27ac3bb
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2020-02-17 21:38:08 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2020-02-17 21:53:22 +0000

    net-libs/webkit-gtk: security cleanup
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <leio@gentoo.org>

 net-libs/webkit-gtk/Manifest                       |   1 -
 .../files/2.26.3-fix-noGL-wayland-build.patch      |  39 ---
 net-libs/webkit-gtk/webkit-gtk-2.26.3-r1.ebuild    | 287 ---------------------
 net-libs/webkit-gtk/webkit-gtk-2.26.3.ebuild       | 287 ---------------------
 4 files changed, 614 deletions(-)

Comment 5 Ovidiu - Dan Bogat 2020-03-03 09:59:01 UTC

There is a new CVE within this version which has been fixed upstream/trunk (commited), but is not yet in the source package.  


CVE-2020-10018 
accessibility/AXObjectCache.cpp in WebKit, as used in WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4, allows a denial of service (application crash) because maintenance of the m_deferredFocusedNodeChange data structure mishandles removal.

https://bugs.webkit.org/show_bug.cgi?id=204342
https://trac.webkit.org/changeset/25729

The bug details are restricted even with an account (at least for me).

Comment 6 Ovidiu - Dan Bogat 2020-03-03 10:02:59 UTC

CVE-2020-10018 changeset https://trac.webkit.org/changeset/257292

Comment 7 Mart Raudsepp gentoo-dev

2020-03-12 14:45:59 UTC

If 2.26.4 doesn't cover it, then file a new bug, this one as part of this security bug has already been handled on most arches.

Comment 8 Sam James archtester

2020-03-12 18:00:30 UTC

(In reply to Mart Raudsepp from comment #7)
> If 2.26.4 doesn't cover it, then file a new bug, this one as part of this
> security bug has already been handled on most arches.

It doesn't: reported as bug 712260

Comment 9 Larry the Git Cow gentoo-dev

2020-03-12 20:08:11 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=35abfda017fa69012bb8f7c768ed24d9b343c281

commit 35abfda017fa69012bb8f7c768ed24d9b343c281
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2020-03-12 20:08:03 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2020-03-12 20:08:03 +0000

    net-libs/webkit-gtk: security cleanup to the extent possible
    
    Vulnerable versions only in ~arch versions now due to lack of
    movement on many architectures on re-keywording
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <leio@gentoo.org>

 net-libs/webkit-gtk/webkit-gtk-2.24.4.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comment 10 Mart Raudsepp gentoo-dev

2020-03-12 20:09:07 UTC

arm64 stable. Cleanup can't be done further due to bug 704182

Comment 11 Thomas Deutschmann (RETIRED) gentoo-dev

2020-03-15 04:35:14 UTC

New GLSA request filed.

Comment 12 GLSAMaker/CVETool Bot gentoo-dev

2020-03-15 04:44:55 UTC

This issue was resolved and addressed in
 GLSA 202003-22 at https://security.gentoo.org/glsa/202003-22
by GLSA coordinator Thomas Deutschmann (whissi).