Arch Linux Security Advisory ASA-202107-68 ========================================== Severity: High Date : 2021-07-27 CVE-ID : CVE-2021-21775 CVE-2021-21779 CVE-2021-30663 CVE-2021-30665 CVE-2021-30689 CVE-2021-30720 CVE-2021-30734 CVE-2021-30744 CVE-2021-30749 CVE-2021-30795 CVE-2021-30797 CVE-2021-30799 Package : wpewebkit Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2221 Summary ======= The package wpewebkit before version 2.32.3-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, cross-site scripting and information disclosure. Resolution ========== Upgrade to 2.32.3-1. # pacman -Syu "wpewebkit>=2.32.3-1" The problems have been fixed upstream in version 2.32.3. Workaround ========== None. Description =========== - CVE-2021-21775 (information disclosure) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of WebKit. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage. - CVE-2021-21779 (information disclosure) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A use-after-free vulnerability exists in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. - CVE-2021-30663 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30665 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. - CVE-2021-30689 (cross-site scripting) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2021-30720 (access restriction bypass) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A malicious website may be able to access restricted ports on arbitrary servers. - CVE-2021-30734 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30744 (cross-site scripting) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2021-30749 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30795 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30797 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to code execution. - CVE-2021-30799 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. Impact ====== A remote attacker could execute arbitrary code or disclose sensitive information through crafted web content. Apple is aware of a report that one of the arbitrary code execution issues may have been actively exploited. References ========== https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-21775 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1229 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-21779 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1238 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30663 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30665 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30689 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30720 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30734 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30744 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30749 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30795 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30797 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30799 https://security.archlinux.org/CVE-2021-21775 https://security.archlinux.org/CVE-2021-21779 https://security.archlinux.org/CVE-2021-30663 https://security.archlinux.org/CVE-2021-30665 https://security.archlinux.org/CVE-2021-30689 https://security.archlinux.org/CVE-2021-30720 https://security.archlinux.org/CVE-2021-30734 https://security.archlinux.org/CVE-2021-30744 https://security.archlinux.org/CVE-2021-30749 https://security.archlinux.org/CVE-2021-30795 https://security.archlinux.org/CVE-2021-30797 https://security.archlinux.org/CVE-2021-30799