Arch Linux Security Advisory ASA-201702-9 ========================================= Severity: Critical Date : 2017-02-11 CVE-ID : CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-170 Summary ======= The package webkit2gtk before version 2.14.4-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass and information disclosure. Resolution ========== Upgrade to 2.14.4-1. # pacman -Syu "webkit2gtk>=2.14.4-1" The problems have been fixed upstream in version 2.14.4. Workaround ========== None. Description =========== - CVE-2017-2350 (information disclosure) A security issue has been found in WebKitGTK+ before 2.14.4, where processing maliciously crafted web content may exfiltrate data cross- origin. - CVE-2017-2354 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2355 (arbitrary code execution) A memory initialization issue has been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2356 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2362 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2363 (information disclosure) Multiple validation issues have been found in the handling of page loading in WebKitGTK+ before 2.14.4, leading to cross-origin data exfiltration while processing maliciously crafted web content. - CVE-2017-2364 (information disclosure) Multiple validation issues have been found in the handling of page loading in WebKitGTK+ before 2.14.4, leading to cross-origin data exfiltration while processing maliciously crafted web content. - CVE-2017-2365 (information disclosure) A validation issue has been found in variable handling in WebKitGTK+ before 2.14.4, leading to cross-origin data exfiltration while processing maliciously crafted web content. - CVE-2017-2366 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2369 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2371 (access restriction bypass) An issue has been found in the handling of blocking popups in WebKitGTK+ before 2.14.4, allowing a malicious website to open popups. - CVE-2017-2373 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. Impact ====== A remote attacker can access sensitive information, bypass access restrictions to open popups, or execute arbitrary code on the affected host via maliciously crafted web content. References ========== https://webkitgtk.org/security/WSA-2017-0002.html https://security.archlinux.org/CVE-2017-2350 https://security.archlinux.org/CVE-2017-2354 https://security.archlinux.org/CVE-2017-2355 https://security.archlinux.org/CVE-2017-2356 https://security.archlinux.org/CVE-2017-2362 https://security.archlinux.org/CVE-2017-2363 https://security.archlinux.org/CVE-2017-2364 https://security.archlinux.org/CVE-2017-2365 https://security.archlinux.org/CVE-2017-2366 https://security.archlinux.org/CVE-2017-2369 https://security.archlinux.org/CVE-2017-2371 https://security.archlinux.org/CVE-2017-2373