[gentoo-announce] [ GLSA 202006-08 ] WebKitGTK+: Multiple vulnerabilities - gentoo-announce

From:	Aaron Bauman <bman@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202006-08 ] WebKitGTK+: Multiple vulnerabilities
Date:	Sat, 13 Jun 2020 02:17:18
Message-Id:	`20200613014159.GF17996@bubba`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202006-08

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: WebKitGTK+: Multiple vulnerabilities

9

     Date: June 13, 2020

10

     Bugs: #712260

11

       ID: 202006-08

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in WebKitGTK+, the worst of

19

which could result in the arbitrary execution of code.

20

21

Background

22

==========

23

24

WebKitGTK+ is a full-featured port of the WebKit rendering engine,

25

suitable for projects requiring any kind of web integration, from

26

hybrid HTML/CSS applications to full-fledged web browsers.

27

28

Affected packages

29

=================

30

31

    -------------------------------------------------------------------

32

     Package              /     Vulnerable     /            Unaffected

33

    -------------------------------------------------------------------

34

  1  net-libs/webkit-gtk          < 2.28.2                  >= 2.28.2 

35

36

Description

37

===========

38

39

Multiple vulnerabilities have been discovered in WebKitGTK+. Please

40

review the CVE identifiers referenced below for details.

41

42

Impact

43

======

44

45

Please review the referenced CVE identifiers for details.

46

47

Workaround

48

==========

49

50

There is no known workaround at this time.

51

52

Resolution

53

==========

54

55

All WebKitGTK+ users should upgrade to the latest version:

56

57

  # emerge --sync

58

  # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.28.2"

59

60

References

61

==========

62

63

[  1 ] CVE-2020-10018

64

       https://nvd.nist.gov/vuln/detail/CVE-2020-10018

65

[  2 ] CVE-2020-10018

66

       https://nvd.nist.gov/vuln/detail/CVE-2020-10018

67

[  3 ] CVE-2020-11793

68

       https://nvd.nist.gov/vuln/detail/CVE-2020-11793

69

[  4 ] CVE-2020-11793

70

       https://nvd.nist.gov/vuln/detail/CVE-2020-11793

71

[  5 ] CVE-2020-3885

72

       https://nvd.nist.gov/vuln/detail/CVE-2020-3885

73

[  6 ] CVE-2020-3894

74

       https://nvd.nist.gov/vuln/detail/CVE-2020-3894

75

[  7 ] CVE-2020-3895

76

       https://nvd.nist.gov/vuln/detail/CVE-2020-3895

77

[  8 ] CVE-2020-3897

78

       https://nvd.nist.gov/vuln/detail/CVE-2020-3897

79

[  9 ] CVE-2020-3899

80

       https://nvd.nist.gov/vuln/detail/CVE-2020-3899

81

[ 10 ] CVE-2020-3900

82

       https://nvd.nist.gov/vuln/detail/CVE-2020-3900

83

[ 11 ] CVE-2020-3901

84

       https://nvd.nist.gov/vuln/detail/CVE-2020-3901

85

[ 12 ] CVE-2020-3902

86

       https://nvd.nist.gov/vuln/detail/CVE-2020-3902

87

88

Availability

89

============

90

91

This GLSA and any updates to it are available for viewing at

92

the Gentoo Security Website:

93

94

 https://security.gentoo.org/glsa/202006-08

95

96

Concerns?

97

=========

98

99

Security is a primary focus of Gentoo Linux and ensuring the

100

confidentiality and security of our users' machines is of utmost

101

importance to us. Any security concerns should be addressed to

102

security@g.o or alternatively, you may file a bug at

103

https://bugs.gentoo.org.

104

105

License

106

=======

107

108

Copyright 2020 Gentoo Foundation, Inc; referenced text

109

belongs to its owner(s).

110

111

The contents of this document are licensed under the

112

Creative Commons - Attribution / Share Alike license.

113

114

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202006-08
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: WebKitGTK+: Multiple vulnerabilities
9	Date: June 13, 2020
10	Bugs: #712260
11	ID: 202006-08
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in WebKitGTK+, the worst of
19	which could result in the arbitrary execution of code.
20
21	Background
22	==========
23
24	WebKitGTK+ is a full-featured port of the WebKit rendering engine,
25	suitable for projects requiring any kind of web integration, from
26	hybrid HTML/CSS applications to full-fledged web browsers.
27
28	Affected packages
29	=================
30
31	-------------------------------------------------------------------
32	Package / Vulnerable / Unaffected
33	-------------------------------------------------------------------
34	1 net-libs/webkit-gtk < 2.28.2 >= 2.28.2
35
36	Description
37	===========
38
39	Multiple vulnerabilities have been discovered in WebKitGTK+. Please
40	review the CVE identifiers referenced below for details.
41
42	Impact
43	======
44
45	Please review the referenced CVE identifiers for details.
46
47	Workaround
48	==========
49
50	There is no known workaround at this time.
51
52	Resolution
53	==========
54
55	All WebKitGTK+ users should upgrade to the latest version:
56
57	# emerge --sync
58	# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.28.2"
59
60	References
61	==========
62
63	[ 1 ] CVE-2020-10018
64	https://nvd.nist.gov/vuln/detail/CVE-2020-10018
65	[ 2 ] CVE-2020-10018
66	https://nvd.nist.gov/vuln/detail/CVE-2020-10018
67	[ 3 ] CVE-2020-11793
68	https://nvd.nist.gov/vuln/detail/CVE-2020-11793
69	[ 4 ] CVE-2020-11793
70	https://nvd.nist.gov/vuln/detail/CVE-2020-11793
71	[ 5 ] CVE-2020-3885
72	https://nvd.nist.gov/vuln/detail/CVE-2020-3885
73	[ 6 ] CVE-2020-3894
74	https://nvd.nist.gov/vuln/detail/CVE-2020-3894
75	[ 7 ] CVE-2020-3895
76	https://nvd.nist.gov/vuln/detail/CVE-2020-3895
77	[ 8 ] CVE-2020-3897
78	https://nvd.nist.gov/vuln/detail/CVE-2020-3897
79	[ 9 ] CVE-2020-3899
80	https://nvd.nist.gov/vuln/detail/CVE-2020-3899
81	[ 10 ] CVE-2020-3900
82	https://nvd.nist.gov/vuln/detail/CVE-2020-3900
83	[ 11 ] CVE-2020-3901
84	https://nvd.nist.gov/vuln/detail/CVE-2020-3901
85	[ 12 ] CVE-2020-3902
86	https://nvd.nist.gov/vuln/detail/CVE-2020-3902
87
88	Availability
89	============
90
91	This GLSA and any updates to it are available for viewing at
92	the Gentoo Security Website:
93
94	https://security.gentoo.org/glsa/202006-08
95
96	Concerns?
97	=========
98
99	Security is a primary focus of Gentoo Linux and ensuring the
100	confidentiality and security of our users' machines is of utmost
101	importance to us. Any security concerns should be addressed to
102	security@g.o or alternatively, you may file a bug at
103	https://bugs.gentoo.org.
104
105	License
106	=======
107
108	Copyright 2020 Gentoo Foundation, Inc; referenced text
109	belongs to its owner(s).
110
111	The contents of this document are licensed under the
112	Creative Commons - Attribution / Share Alike license.
113
114	https://creativecommons.org/licenses/by-sa/2.5