oss-sec mailing list archives
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004
From: John Helmert III <ajak () gentoo org>
Date: Fri, 8 Apr 2022 13:41:59 -0500
On Fri, Apr 08, 2022 at 12:31:18PM -0500, John Helmert III wrote:
The issue I described last time has come up again here [1]. 2.36.0 was released on March 21, almost three weeks ago now, and its WSA was released today. Why the long wait? Three of these issues are fixed in 2.36.0 and 2.34.7, but I can't find a release for 2.34.7 [2][3]. Is it released yet?
I'm sorry, I misread the descriptions. That version refers to WPE WebKit rather than WebKitGTK.
[1] https://www.openwall.com/lists/oss-security/2022/01/23/1 [2] https://webkitgtk.org/news.html [3] https://webkitgtk.org/releases/ On Fri, Apr 08, 2022 at 02:31:29PM +0100, Carlos Alberto Lopez Perez wrote:------------------------------------------------------------------------ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004 ------------------------------------------------------------------------ Date reported : April 08, 2022 Advisory ID : WSA-2022-0004 WebKitGTK Advisory URL : https://webkitgtk.org/security/WSA-2022-0004.html WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2022-0004.html CVE identifiers : CVE-2022-22624, CVE-2022-22628, CVE-2022-22629, CVE-2022-22637. Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-22624 Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7 Credit to Kirin (@Pwnrin) of Tencent Security Xuanwu Lab. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management. CVE-2022-22628 Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7 Credit to Kirin (@Pwnrin) of Tencent Security Xuanwu Lab. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management. CVE-2022-22629 Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7 Credit to Jeonghoon Shin at Theori working with Trend Micro Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A buffer overflow issue was addressed with improved memory handling. CVE-2022-22637 Versions affected: WebKitGTK before 2.34.4 and WPE WebKit before 2.34.4 Credit to Tom McKee of Google. Impact: A malicious website may cause unexpected cross-origin behavior. Description: A logic issue was addressed with improved state management. We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/. The WebKitGTK and WPE WebKit team, April 08, 2022
Attachment:
signature.asc
Description:
Current thread:
- WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004 Carlos Alberto Lopez Perez (Apr 08)
- Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004 John Helmert III (Apr 08)
- Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004 John Helmert III (Apr 08)
- Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004 John Helmert III (Apr 08)