Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 709612 (CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, WSA-2020-0002)

Summary: <net-libs/webkit-gtk-2.26.4: multiple vulnerabilities
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: gnome, ovi
Priority: Normal Flags: stable-bot: sanity-check+
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A3 [glsa+ cve]
Package list:
gui-libs/libwpe-1.4.0.1 gui-libs/wpebackend-fdo-1.4.0 sys-apps/xdg-dbus-proxy-0.1.2 net-libs/webkit-gtk-2.26.4
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2020-02-14 14:25:31 UTC
From https://www.openwall.com/lists/oss-security/2020/02/14/6 :

------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory                 WSA-2020-0002
------------------------------------------------------------------------

Date reported           : February 14, 2020
Advisory ID             : WSA-2020-0002
WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2020-0002.html
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2020-0002.html
CVE identifiers         : CVE-2020-3862, CVE-2020-3864, CVE-2020-3865,
                          CVE-2020-3867, CVE-2020-3868.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2020-3862
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to Srikanth Gatta of Google Chrome.
    Impact: A malicious website may be able to cause a denial of
    service. Description: A denial of service issue was addressed with
    improved memory handling.

CVE-2020-3864
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to Ryan Pickren (ryanpickren.com).
    Impact: A DOM object context may not have had a unique security
    origin. Description: A logic issue was addressed with improved
    validation.

CVE-2020-3865
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to Ryan Pickren (ryanpickren.com).
    Impact: A top-level DOM object context may have incorrectly been
    considered secure. Description: A logic issue was addressed with
    improved validation.

CVE-2020-3867
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to an anonymous researcher.
    Impact: Processing maliciously crafted web content may lead to
    universal cross site scripting. Description: A logic issue was
    addressed with improved state management.

CVE-2020-3868
    Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before
    2.26.4.
    Credit to Marcin Towalski of Cisco Talos.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: Multiple memory corruption
    issues were addressed with improved memory handling.


We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.

The WebKitGTK and WPE WebKit team,
February 14, 2020


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Larry the Git Cow gentoo-dev 2020-02-14 22:15:51 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fb2dcb0fecee802258e1501ef657f6de2a4c99a0

commit fb2dcb0fecee802258e1501ef657f6de2a4c99a0
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2020-02-14 22:14:37 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2020-02-14 22:14:54 +0000

    net-libs/webkit-gtk: security bump to 2.26.4
    
    -r0 is for fast security stabling, -r1 is the enchant:2 ensuring
    revision.
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <leio@gentoo.org>

 net-libs/webkit-gtk/Manifest                    |   1 +
 net-libs/webkit-gtk/webkit-gtk-2.26.4-r1.ebuild | 286 ++++++++++++++++++++++++
 net-libs/webkit-gtk/webkit-gtk-2.26.4.ebuild    | 286 ++++++++++++++++++++++++
 3 files changed, 573 insertions(+)
Comment 2 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2020-02-15 12:20:49 UTC
amd64 stable
Comment 3 Thomas Deutschmann gentoo-dev Security 2020-02-16 21:16:40 UTC
x86 stable
Comment 4 Larry the Git Cow gentoo-dev 2020-02-17 21:54:01 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0f61be8a83c5fb4c088d60a8bf0acaaa27ac3bb

commit a0f61be8a83c5fb4c088d60a8bf0acaaa27ac3bb
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2020-02-17 21:38:08 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2020-02-17 21:53:22 +0000

    net-libs/webkit-gtk: security cleanup
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <leio@gentoo.org>

 net-libs/webkit-gtk/Manifest                       |   1 -
 .../files/2.26.3-fix-noGL-wayland-build.patch      |  39 ---
 net-libs/webkit-gtk/webkit-gtk-2.26.3-r1.ebuild    | 287 ---------------------
 net-libs/webkit-gtk/webkit-gtk-2.26.3.ebuild       | 287 ---------------------
 4 files changed, 614 deletions(-)
Comment 5 Ovidiu - Dan Bogat 2020-03-03 09:59:01 UTC
There is a new CVE within this version which has been fixed upstream/trunk (commited), but is not yet in the source package.  


CVE-2020-10018 
accessibility/AXObjectCache.cpp in WebKit, as used in WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4, allows a denial of service (application crash) because maintenance of the m_deferredFocusedNodeChange data structure mishandles removal.

https://bugs.webkit.org/show_bug.cgi?id=204342
https://trac.webkit.org/changeset/25729

The bug details are restricted even with an account (at least for me).
Comment 6 Ovidiu - Dan Bogat 2020-03-03 10:02:59 UTC
CVE-2020-10018 changeset https://trac.webkit.org/changeset/257292
Comment 7 Mart Raudsepp gentoo-dev 2020-03-12 14:45:59 UTC
If 2.26.4 doesn't cover it, then file a new bug, this one as part of this security bug has already been handled on most arches.
Comment 8 Sam James archtester gentoo-dev Security 2020-03-12 18:00:30 UTC
(In reply to Mart Raudsepp from comment #7)
> If 2.26.4 doesn't cover it, then file a new bug, this one as part of this
> security bug has already been handled on most arches.

It doesn't: reported as bug 712260
Comment 9 Larry the Git Cow gentoo-dev 2020-03-12 20:08:11 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=35abfda017fa69012bb8f7c768ed24d9b343c281

commit 35abfda017fa69012bb8f7c768ed24d9b343c281
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2020-03-12 20:08:03 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2020-03-12 20:08:03 +0000

    net-libs/webkit-gtk: security cleanup to the extent possible
    
    Vulnerable versions only in ~arch versions now due to lack of
    movement on many architectures on re-keywording
    
    Bug: https://bugs.gentoo.org/709612
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Signed-off-by: Mart Raudsepp <leio@gentoo.org>

 net-libs/webkit-gtk/webkit-gtk-2.24.4.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 10 Mart Raudsepp gentoo-dev 2020-03-12 20:09:07 UTC
arm64 stable. Cleanup can't be done further due to bug 704182
Comment 11 Thomas Deutschmann gentoo-dev Security 2020-03-15 04:35:14 UTC
New GLSA request filed.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2020-03-15 04:44:55 UTC
This issue was resolved and addressed in
 GLSA 202003-22 at https://security.gentoo.org/glsa/202003-22
by GLSA coordinator Thomas Deutschmann (whissi).