Bugzilla – Bug 1050469
VUL-0: libqt5-qtwebkit, libQtWebKit4, webkitgtk3, webkitgtk, webkit2gtk3: WebKitGTK+ Security Advisory WSA-2017-0006
Last modified: 2022-04-11 08:17:11 UTC
From https://webkitgtk.org/security/WSA-2017-0006.html ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2017-0006 ------------------------------------------------------------------------ Date reported : July 25, 2017 Advisory ID : WSA-2017-0006 Advisory URL : https://webkitgtk.org/security/WSA-2017-0006.html CVE identifiers : CVE-2017-7006, CVE-2017-7011, CVE-2017-7012, CVE-2017-7018, CVE-2017-7019, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7038, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7059, CVE-2017-7061, CVE-2017-7064. Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-7006 Versions affected: WebKitGTK+ before 2.16.2. Credit to David Kohlbrenner of UC San Diego, an anonymous researcher. Impact: A malicious website may exfiltrate data cross-origin. Description: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered. CVE-2017-7011 Versions affected: WebKitGTK+ before 2.16.3. Credit to xisigr of Tencent's Xuanwu Lab (tencent.com). Impact: Visiting a malicious website may lead to address bar spoofing. Description: A state management issue was addressed with improved frame handling. CVE-2017-7012 Versions affected: WebKitGTK+ before 2.16.2. Credit to Apple. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7018 Versions affected: WebKitGTK+ before 2.16.6. Credit to lokihardt of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7019 Versions affected: WebKitGTK+ before 2.16.2. Credit to Zhiyang Zeng of Tencent Security Platform Department. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7020 Versions affected: WebKitGTK+ before 2.16.1. Credit to likemeng of Baidu Security Lab. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7030 Versions affected: WebKitGTK+ before 2.16.6. Credit to chenqin of Ant-financial Light-Year Security Lab (蚂蚁金服巴斯光年安全实验室). Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7034 Versions affected: WebKitGTK+ before 2.16.6. Credit to chenqin of Ant-financial Light-Year Security Lab (蚂蚁金服巴斯光年安全实验室). Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7037 Versions affected: WebKitGTK+ before 2.16.6. Credit to lokihardt of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7038 Versions affected: WebKitGTK+ before 2.16.2. Credit to Neil Jenkins of FastMail Pty Ltd, Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security. Impact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting. Description: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management. CVE-2017-7039 Versions affected: WebKitGTK+ before 2.16.6. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7040 Versions affected: WebKitGTK+ before 2.16.3. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7041 Versions affected: WebKitGTK+ before 2.16.2. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7042 Versions affected: WebKitGTK+ before 2.16.2. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7043 Versions affected: WebKitGTK+ before 2.16.2. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7046 Versions affected: WebKitGTK+ before 2.16.6. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7048 Versions affected: WebKitGTK+ before 2.16.6. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7049 Versions affected: WebKitGTK+ before 2.16.2. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2017-7052 Versions affected: WebKitGTK+ before 2.16.4. Credit to cc working with Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7055 Versions affected: WebKitGTK+ before 2.16.6. Credit to The UK's National Cyber Security Centre (NCSC). Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7056 Versions affected: WebKitGTK+ before 2.16.6. Credit to lokihardt of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7059 Versions affected: WebKitGTK+ before 2.16.3. Credit to an anonymous researcher. Impact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting. Description: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management. CVE-2017-7061 Versions affected: WebKitGTK+ before 2.16.6. Credit to lokihardt of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7064 Versions affected: WebKitGTK+ before 2.16.6. Credit to lokihardt of Google Project Zero. Impact: An application may be able to read restricted memory. Description: A memory initialization issue was addressed through improved memory handling. We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html The WebKitGTK+ team, July 25, 2017 .......... oss-sec: http://seclists.org/oss-sec/2017/q3/210 From https://webkitgtk.org/2017/07/24/webkitgtk2.16.6-released.html WebKitGTK+ 2.16.6 released! This is a bug fix release in the stable 2.16 series. What’s new in the WebKitGTK+ 2.16.6 release? Fix rendering of spin buttons with GTK+ >= 3.20 when the entry width is too short. Fix the build when Wayland target is enabled and X11 disabled. Fix several crashes and rendering issues. Security fixes: CVE-2017-7039, CVE-2017-7018, CVE-2017-7030, CVE-2017-7037, CVE-2017-7034, CVE-2017-7055, CVE-2017-7056, CVE-2017-7064, CVE-2017-7061, CVE-2017-7048, CVE-2017-7046.
Dirk, adding you for libQtWebKit4
as explained before I'll not fix libQtWebKit4, ever. if you ship it on a security sensitive product then please get it removed from there.
For libqt5-qtwebkit, due to horrible webkit maintain, it's impossible cherry-pick patches for individual CVE, the commits doesn't mentioned any CVE tag in the upstream's tree; also qtwebkit's webkit engine haven't got update since qt 5.2 therefore cherry-pick is not easy to do, and it's hard to say those vulnerabilities also exists in the old webkit but I assumed yes. After discussed with Antonio we agree we should update libqt5-qtwebkit to annulen's branch(upstream branch 5.212) which imported recently webkit update to qtwebkit, the version now is alpha2(WSA-2017-0006 doesn't included in alpha2 though), I'm already working on it, is the security team ok with this way?
(In reply to Max Lin from comment #5) For such a change we need to go through an ECO. I agree with you that it is probably the only way to get those fixes, but changes this size can't be accepted without evaluation in an ECO first.
(In reply to Johannes Segitz from comment #7) > (In reply to Max Lin from comment #5) > For such a change we need to go through an ECO. I agree with you that it is > probably the only way to get those fixes, but changes this size can't be > accepted without evaluation in an ECO first. Hi Johannes, who can help to open an ECO for this issue?
opened FATE#323918: [ECO] version upgrade of libQtWebkit5
SUSE-SU-2017:2933-1: An update that fixes 40 vulnerabilities is now available. Category: security (important) Bug References: 1020950,1024749,1045460,1050469 CVE References: CVE-2016-7586,CVE-2016-7589,CVE-2016-7592,CVE-2016-7599,CVE-2016-7623,CVE-2016-7632,CVE-2016-7635,CVE-2016-7639,CVE-2016-7641,CVE-2016-7645,CVE-2016-7652,CVE-2016-7654,CVE-2016-7656,CVE-2017-2350,CVE-2017-2354,CVE-2017-2355,CVE-2017-2356,CVE-2017-2362,CVE-2017-2363,CVE-2017-2364,CVE-2017-2365,CVE-2017-2366,CVE-2017-2369,CVE-2017-2371,CVE-2017-2373,CVE-2017-2496,CVE-2017-2510,CVE-2017-2538,CVE-2017-2539,CVE-2017-7018,CVE-2017-7030,CVE-2017-7034,CVE-2017-7037,CVE-2017-7039,CVE-2017-7046,CVE-2017-7048,CVE-2017-7055,CVE-2017-7056,CVE-2017-7061,CVE-2017-7064 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): webkit2gtk3-2.18.0-2.9.1 SUSE Linux Enterprise Workstation Extension 12-SP2 (src): webkit2gtk3-2.18.0-2.9.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): webkit2gtk3-2.18.0-2.9.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): webkit2gtk3-2.18.0-2.9.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): webkit2gtk3-2.18.0-2.9.1 SUSE Linux Enterprise Server 12-SP3 (src): webkit2gtk3-2.18.0-2.9.1 SUSE Linux Enterprise Server 12-SP2 (src): webkit2gtk3-2.18.0-2.9.1 SUSE Linux Enterprise Desktop 12-SP3 (src): webkit2gtk3-2.18.0-2.9.1 SUSE Linux Enterprise Desktop 12-SP2 (src): webkit2gtk3-2.18.0-2.9.1
openSUSE-SU-2017:2991-1: An update that fixes 40 vulnerabilities is now available. Category: security (important) Bug References: 1020950,1024749,1045460,1050469 CVE References: CVE-2016-7586,CVE-2016-7589,CVE-2016-7592,CVE-2016-7599,CVE-2016-7623,CVE-2016-7632,CVE-2016-7635,CVE-2016-7639,CVE-2016-7641,CVE-2016-7645,CVE-2016-7652,CVE-2016-7654,CVE-2016-7656,CVE-2017-2350,CVE-2017-2354,CVE-2017-2355,CVE-2017-2356,CVE-2017-2362,CVE-2017-2363,CVE-2017-2364,CVE-2017-2365,CVE-2017-2366,CVE-2017-2369,CVE-2017-2371,CVE-2017-2373,CVE-2017-2496,CVE-2017-2510,CVE-2017-2538,CVE-2017-2539,CVE-2017-7018,CVE-2017-7030,CVE-2017-7034,CVE-2017-7037,CVE-2017-7039,CVE-2017-7046,CVE-2017-7048,CVE-2017-7055,CVE-2017-7056,CVE-2017-7061,CVE-2017-7064 Sources used: openSUSE Leap 42.3 (src): webkit2gtk3-2.18.0-5.1 openSUSE Leap 42.2 (src): webkit2gtk3-2.18.0-2.3.1
SUSE-SU-2017:3062-1: An update that contains security fixes can now be installed. Category: security (moderate) Bug References: 1050469 CVE References: Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): gimp-2.8.18-9.3.26 SUSE Linux Enterprise Workstation Extension 12-SP2 (src): gimp-2.8.18-9.3.26 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): gimp-2.8.18-9.3.26 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): gimp-2.8.18-9.3.26 SUSE Linux Enterprise Desktop 12-SP3 (src): gimp-2.8.18-9.3.26 SUSE Linux Enterprise Desktop 12-SP2 (src): gimp-2.8.18-9.3.26
SUSE-RU-2017:3077-1: An update that has one recommended fix can now be installed. Category: recommended (low) Bug References: 1050469 CVE References: Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): empathy-3.12.13-8.3.28 SUSE Linux Enterprise Workstation Extension 12-SP2 (src): empathy-3.12.13-8.3.28 SUSE Linux Enterprise Desktop 12-SP3 (src): empathy-3.12.13-8.3.28 SUSE Linux Enterprise Desktop 12-SP2 (src): empathy-3.12.13-8.3.28
openSUSE-RU-2017:3094-1: An update that has one recommended fix can now be installed. Category: recommended (low) Bug References: 1050469 CVE References: Sources used: openSUSE Leap 42.3 (src): empathy-3.12.13-6.1 openSUSE Leap 42.2 (src): empathy-3.12.13-2.6.1
openSUSE-SU-2018:0044-1: An update that contains security fixes can now be installed. Category: security (moderate) Bug References: 1050469 CVE References: Sources used: openSUSE Leap 42.3 (src): gimp-2.8.18-6.3 openSUSE Leap 42.2 (src): gimp-2.8.18-2.6.2
SUSE-SU-2018:0219-1: An update that fixes 89 vulnerabilities is now available. Category: security (important) Bug References: 1020950,1024749,1050469,1066892,1069925,1073654,1075419 CVE References: CVE-2016-4692,CVE-2016-4743,CVE-2016-7586,CVE-2016-7587,CVE-2016-7589,CVE-2016-7592,CVE-2016-7598,CVE-2016-7599,CVE-2016-7610,CVE-2016-7623,CVE-2016-7632,CVE-2016-7635,CVE-2016-7639,CVE-2016-7641,CVE-2016-7645,CVE-2016-7652,CVE-2016-7654,CVE-2016-7656,CVE-2017-13788,CVE-2017-13798,CVE-2017-13803,CVE-2017-13856,CVE-2017-13866,CVE-2017-13870,CVE-2017-2350,CVE-2017-2354,CVE-2017-2355,CVE-2017-2356,CVE-2017-2362,CVE-2017-2363,CVE-2017-2364,CVE-2017-2365,CVE-2017-2366,CVE-2017-2369,CVE-2017-2371,CVE-2017-2373,CVE-2017-2496,CVE-2017-2510,CVE-2017-2539,CVE-2017-5715,CVE-2017-5753,CVE-2017-5754,CVE-2017-7006,CVE-2017-7011,CVE-2017-7012,CVE-2017-7018,CVE-2017-7019,CVE-2017-7020,CVE-2017-7030,CVE-2017-7034,CVE-2017-7037,CVE-2017-7038,CVE-2017-7039,CVE-2017-7040,CVE-2017-7041,CVE-2017-7042,CVE-2017-7043,CVE-2017-7046,CVE-2017-7048,CVE-2017-7049,CVE-2017-7052,CVE-2017-7055,CVE-2017-7056,CVE-2017-7059,CVE-2017-7061,CVE-2017-7064,CVE-2017-7081,CVE-2017-7087,CVE-2017-7089,CVE-2017-7090,CVE-2017-7091,CVE-2017-7092,CVE-2017-7093,CVE-2017-7094,CVE-2017-7095,CVE-2017-7096,CVE-2017-7098,CVE-2017-7099,CVE-2017-7100,CVE-2017-7102,CVE-2017-7104,CVE-2017-7107,CVE-2017-7109,CVE-2017-7111,CVE-2017-7117,CVE-2017-7120,CVE-2017-7142,CVE-2017-7156,CVE-2017-7157 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): webkit2gtk3-2.18.5-2.18.1 SUSE Linux Enterprise Workstation Extension 12-SP2 (src): webkit2gtk3-2.18.5-2.18.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): webkit2gtk3-2.18.5-2.18.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): webkit2gtk3-2.18.5-2.18.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): webkit2gtk3-2.18.5-2.18.1 SUSE Linux Enterprise Server 12-SP3 (src): webkit2gtk3-2.18.5-2.18.1 SUSE Linux Enterprise Server 12-SP2 (src): webkit2gtk3-2.18.5-2.18.1 SUSE Linux Enterprise Desktop 12-SP3 (src): webkit2gtk3-2.18.5-2.18.1 SUSE Linux Enterprise Desktop 12-SP2 (src): webkit2gtk3-2.18.5-2.18.1
openSUSE-SU-2018:0326-1: An update that fixes 89 vulnerabilities is now available. Category: security (important) Bug References: 1020950,1024749,1050469,1066892,1069925,1073654,1075419 CVE References: CVE-2016-4692,CVE-2016-4743,CVE-2016-7586,CVE-2016-7587,CVE-2016-7589,CVE-2016-7592,CVE-2016-7598,CVE-2016-7599,CVE-2016-7610,CVE-2016-7623,CVE-2016-7632,CVE-2016-7635,CVE-2016-7639,CVE-2016-7641,CVE-2016-7645,CVE-2016-7652,CVE-2016-7654,CVE-2016-7656,CVE-2017-13788,CVE-2017-13798,CVE-2017-13803,CVE-2017-13856,CVE-2017-13866,CVE-2017-13870,CVE-2017-2350,CVE-2017-2354,CVE-2017-2355,CVE-2017-2356,CVE-2017-2362,CVE-2017-2363,CVE-2017-2364,CVE-2017-2365,CVE-2017-2366,CVE-2017-2369,CVE-2017-2371,CVE-2017-2373,CVE-2017-2496,CVE-2017-2510,CVE-2017-2539,CVE-2017-5715,CVE-2017-5753,CVE-2017-5754,CVE-2017-7006,CVE-2017-7011,CVE-2017-7012,CVE-2017-7018,CVE-2017-7019,CVE-2017-7020,CVE-2017-7030,CVE-2017-7034,CVE-2017-7037,CVE-2017-7038,CVE-2017-7039,CVE-2017-7040,CVE-2017-7041,CVE-2017-7042,CVE-2017-7043,CVE-2017-7046,CVE-2017-7048,CVE-2017-7049,CVE-2017-7052,CVE-2017-7055,CVE-2017-7056,CVE-2017-7059,CVE-2017-7061,CVE-2017-7064,CVE-2017-7081,CVE-2017-7087,CVE-2017-7089,CVE-2017-7090,CVE-2017-7091,CVE-2017-7092,CVE-2017-7093,CVE-2017-7094,CVE-2017-7095,CVE-2017-7096,CVE-2017-7098,CVE-2017-7099,CVE-2017-7100,CVE-2017-7102,CVE-2017-7104,CVE-2017-7107,CVE-2017-7109,CVE-2017-7111,CVE-2017-7117,CVE-2017-7120,CVE-2017-7142,CVE-2017-7156,CVE-2017-7157 Sources used: openSUSE Leap 42.3 (src): webkit2gtk3-2.18.5-8.1
This is an autogenerated message for OBS integration: This bug (1050469) was mentioned in https://build.opensuse.org/request/show/576797 Factory / libqt5-qtwebkit
This is an autogenerated message for OBS integration: This bug (1050469) was mentioned in https://build.opensuse.org/request/show/577975 15.0 / libqt5-qtwebkit
Done.