Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 635134 (CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142, WSA-2017-0008) - <net-libs/webkit-gtk-2.18.1: multiple vulnerabilities
Summary: <net-libs/webkit-gtk-2.18.1: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142, WSA-2017-0008
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://www.webkitgtk.org/security/WS...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on: 635144
Blocks:
  Show dependency tree
 
Reported: 2017-10-23 04:14 UTC by D'juan McDonald (domhnall)
Modified: 2017-10-29 22:31 UTC (History)
1 user (show)

See Also:
Package list:
net-libs/webkit-gtk-2.18.2
Runtime testing required: Yes
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description D'juan McDonald (domhnall) 2017-10-23 04:14:19 UTC 
See {URL}:

@maintainer(s), commit 3f020256 is already in tree. Call for stabilization when ready.
> net-libs/webkit-gtk: bump to 2.18.1 for security; other package touchups.
> Mart Raudsepp, Sun, 22 Oct 2017 17:59

Gentoo Security Padawan
Daj Uan (jmbailey)
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2017-10-23 15:05:14 UTC 
CVE-2017-7127 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7127):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. macOS before 10.13 is affected. iCloud before 7.0 on Windows is
  affected. tvOS before 11 is affected. watchOS before 4 is affected. The
  issue involves the "SQLite" component. It allows attackers to execute
  arbitrary code in a privileged context or cause a denial of service (memory
  corruption) via a crafted app.

CVE-2017-7120 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7120):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7117 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7117):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7111 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7111):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7109 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7109):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. A cross-site scripting
  (XSS) vulnerability allows remote attackers to inject arbitrary web script
  or HTML via crafted web content that incorrectly interacts with the
  Application Cache policy.

CVE-2017-7107 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7107):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7106 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7106):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to spoof the address bar.

CVE-2017-7104 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7104):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7102 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7102):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7100 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7100):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7099 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7099):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7098 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7098):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7096 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7096):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7095 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7095):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7094 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7094):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7093 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7093):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7092 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7092):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7091 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7091):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7090 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7090):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to bypass the Same Origin Policy and obtain sensitive cookie
  information via a custom URL scheme.

CVE-2017-7089 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7089):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to conduct Universal XSS (UXSS) attacks via a crafted web site
  that is mishandled during parent-tab processing.

CVE-2017-7087 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7087):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.

CVE-2017-7081 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7081):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. iCloud before 7.0 on Windows is
  affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is
  affected. The issue involves the "WebKit" component. It allows remote
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption and application crash) via a crafted web site.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2017-10-23 15:06:37 UTC 
CVE-2017-7144 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7144):
  An issue was discovered in certain Apple products. iOS before 11 is
  affected. Safari before 11 is affected. The issue involves the "WebKit"
  component. It allows remote attackers to track Safari Private Browsing users
  by leveraging cookie mishandling.

CVE-2017-7142 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7142):
  An issue was discovered in certain Apple products. Safari before 11 is
  affected. The issue involves the "WebKit Storage" component. It allows
  attackers to bypass the Safari Private Browsing protection mechanism, and
  consequently obtain sensitive information about visited web sites.
Comment 3 Mart Raudsepp gentoo-dev 2017-10-26 13:01:28 UTC 
We should be able to proceed now.
It would be good if a casual runtime check with stable epiphany (2.22.x) is done on one of the architectures. E.g just a youtube video, maybe gmail login.
Comment 4 Mart Raudsepp gentoo-dev 2017-10-27 11:07:25 UTC 
Temporarily withdrawing stabilization. 2.18.2 was released, which seems to have rather important regression fixes. I will try to bump and request stabilization of it before end of weekend for fixing these security issues referenced here.
Comment 5 Agostino Sarubbo gentoo-dev 2017-10-29 15:55:31 UTC 
amd64 stable
Comment 6 Thomas Deutschmann (RETIRED) gentoo-dev 2017-10-29 21:09:35 UTC 
x86 stable


@ Maintainer(s): Please cleanup!
Comment 7 Larry the Git Cow gentoo-dev 2017-10-29 22:11:40 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=71049fe1e3a508e5fa82b7716e00cbbde8fd3d37

commit 71049fe1e3a508e5fa82b7716e00cbbde8fd3d37
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2017-10-29 22:11:17 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2017-10-29 22:11:17 +0000

    net-libs/webkit-gtk: security cleanup
    
    Bug: https://bugs.gentoo.org/635134
    Package-Manager: Portage-2.3.8, Repoman-2.3.2

 net-libs/webkit-gtk/Manifest                       |   2 -
 .../files/webkit-gtk-2.8.5-fix-alpha-build.patch   |  22 --
 net-libs/webkit-gtk/webkit-gtk-2.16.6.ebuild       | 288 ---------------------
 net-libs/webkit-gtk/webkit-gtk-2.18.1.ebuild       | 284 --------------------
 4 files changed, 596 deletions(-)}
Comment 8 Mart Raudsepp gentoo-dev 2017-10-29 22:12:19 UTC 
cleanup done. As usual, SLOT=2 and SLOT=3 versions remain, which is tracked in an old security bug.
Comment 9 Aaron Bauman (RETIRED) gentoo-dev 2017-10-29 22:31:11 UTC 
GLSA Vote: No

Thanks, Leio!