Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004

[John Helmert III <ajak () gentoo org>]

On Fri, Apr 08, 2022 at 12:31:18PM -0500, John Helmert III wrote:
> The issue I described last time has come up again here [1]. 2.36.0 was
> released on March 21, almost three weeks ago now, and its WSA was
> released today. Why the long wait?
>
> Three of these issues are fixed in 2.36.0 and 2.34.7, but I can't find
> a release for 2.34.7 [2][3]. Is it released yet?

I'm sorry, I misread the descriptions. That version refers to WPE
WebKit rather than WebKitGTK.

> [1] https://www.openwall.com/lists/oss-security/2022/01/23/1
> [2] https://webkitgtk.org/news.html
> [3] https://webkitgtk.org/releases/
>
> On Fri, Apr 08, 2022 at 02:31:29PM +0100, Carlos Alberto Lopez Perez wrote:
> > ------------------------------------------------------------------------
> > WebKitGTK and WPE WebKit Security Advisory                 WSA-2022-0004
> > ------------------------------------------------------------------------
> >
> > Date reported           : April 08, 2022
> > Advisory ID             : WSA-2022-0004
> > WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2022-0004.html
> > WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2022-0004.html
> > CVE identifiers         : CVE-2022-22624, CVE-2022-22628,
> >                           CVE-2022-22629, CVE-2022-22637.
> >
> > Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.
> >
> > CVE-2022-22624
> >     Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7
> >     Credit to Kirin (@Pwnrin) of Tencent Security Xuanwu Lab.
> >     Impact: Processing maliciously crafted web content may lead to
> >     arbitrary code execution. Description: A use after free issue was
> >     addressed with improved memory management.
> >
> > CVE-2022-22628
> >     Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7
> >     Credit to Kirin (@Pwnrin) of Tencent Security Xuanwu Lab.
> >     Impact: Processing maliciously crafted web content may lead to
> >     arbitrary code execution. Description: A use after free issue was
> >     addressed with improved memory management.
> >
> > CVE-2022-22629
> >     Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7
> >     Credit to Jeonghoon Shin at Theori working with Trend Micro Zero Day
> >     Initiative.
> >     Impact: Processing maliciously crafted web content may lead to
> >     arbitrary code execution. Description: A buffer overflow issue was
> >     addressed with improved memory handling.
> >
> > CVE-2022-22637
> >     Versions affected: WebKitGTK before 2.34.4 and WPE WebKit before 2.34.4
> >     Credit to Tom McKee of Google.
> >     Impact: A malicious website may cause unexpected cross-origin
> >     behavior. Description: A logic issue was addressed with improved
> >     state management.
> >
> >
> > We recommend updating to the latest stable versions of WebKitGTK and WPE
> > WebKit. It is the best way to ensure that you are running safe versions
> > of WebKit. Please check our websites for information about the latest
> > stable releases.
> >
> > Further information about WebKitGTK and WPE WebKit security advisories
> > can be found at: https://webkitgtk.org/security.html or
> > https://wpewebkit.org/security/.
> >
> > The WebKitGTK and WPE WebKit team,
> > April 08, 2022

Attachment: signature.asc
Description: