CVE-2024-23252 Versions affected: WebKitGTK and WPE WebKit before 2.44.0. Credit to anbu1024 of SecANT. Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 263758 CVE-2024-23254 Versions affected: WebKitGTK and WPE WebKit before 2.44.0. Credit to James Lee (@Windowsrcer). Impact: A malicious website may exfiltrate audio data cross-origin. Description: The issue was addressed with improved UI handling. WebKit Bugzilla: 263795 CVE-2024-23263 Versions affected: WebKitGTK and WPE WebKit before 2.44.0. Credit to Johan Carlsson (joaxcar). Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved validation. WebKit Bugzilla: 264811 CVE-2024-23280 Versions affected: WebKitGTK and WPE WebKit before 2.44.0. Credit to An anonymous researcher. Impact: A maliciously crafted webpage may be able to fingerprint the user. Description: An injection issue was addressed with improved validation. WebKit Bugzilla: 266703 CVE-2024-23284 Versions affected: WebKitGTK and WPE WebKit before 2.44.0. Credit to Georg Felber and Marco Squarcina. Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 267241 CVE-2023-42950 Versions affected: WebKitGTK and WPE WebKit before 2.44.0. Credit to Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute and rushikesh nandedkar. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management. WebKit Bugzilla: 263682 CVE-2023-42956 Versions affected: WebKitGTK and WPE WebKit before 2.44.0. Credit to SungKwon Lee (Demon.Team). Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 263989 CVE-2023-42843 Versions affected: WebKitGTK and WPE WebKit before 2.44.0. Credit to Kacper Kwapisz (@KKKas_). Impact: Visiting a malicious website may lead to address bar spoofing. Description: An inconsistent user interface issue was addressed with improved state management. WebKit Bugzilla: 260046
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fceeef1e0b2bbeab82426a2d1b1559c81c23c446 commit fceeef1e0b2bbeab82426a2d1b1559c81c23c446 Author: Mart Raudsepp <leio@gentoo.org> AuthorDate: 2024-04-20 11:38:27 +0000 Commit: Mart Raudsepp <leio@gentoo.org> CommitDate: 2024-04-20 11:41:38 +0000 net-libs/webkit-gtk: security cleanup Bug: https://bugs.gentoo.org/930116 Signed-off-by: Mart Raudsepp <leio@gentoo.org> net-libs/webkit-gtk/Manifest | 1 - .../files/2.42.1-arm64-non-jumbo-fix.patch | 38 --- .../webkit-gtk/files/2.42.4-wasm-assert-fix.patch | 53 ---- .../webkit-gtk/files/2.42.5-x86-build-fix.patch | 33 --- net-libs/webkit-gtk/webkit-gtk-2.42.5-r410.ebuild | 272 --------------------- net-libs/webkit-gtk/webkit-gtk-2.42.5-r600.ebuild | 265 -------------------- net-libs/webkit-gtk/webkit-gtk-2.42.5.ebuild | 262 -------------------- 7 files changed, 924 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=6c98e30895374eb197e0bbe54787501361bbc96b commit 6c98e30895374eb197e0bbe54787501361bbc96b Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2024-07-05 07:33:55 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2024-07-05 07:34:34 +0000 [ GLSA 202407-13 ] WebKitGTK+: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/923851 Bug: https://bugs.gentoo.org/930116 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202407-13.xml | 64 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+)
