[ASA-202002-10] webkit2gtk: multiple issues
foxboron at archlinux.org
Sat Feb 29 13:27:15 UTC 2020
Arch Linux Security Advisory ASA-202002-10
Date : 2020-02-17
CVE-ID : CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867
Package : webkit2gtk
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1100
The package webkit2gtk before version 2.26.4-1 is vulnerable to
multiple issues including arbitrary code execution, cross-site
scripting, sandbox escape, denial of service and same-origin policy
Upgrade to 2.26.4-1.
# pacman -Syu "webkit2gtk>=2.26.4-1"
The problems have been fixed upstream in version 2.26.4.
- CVE-2020-3862 (denial of service)
A malicious website may be able to cause a denial of service.
- CVE-2020-3864 (same-origin policy bypass)
A DOM object context may not have had a unique security origin.
- CVE-2020-3865 (sandbox escape)
A top-level DOM object context may have incorrectly been considered
- CVE-2020-3867 (cross-site scripting)
Processing maliciously crafted web content may lead to universal cross
- CVE-2020-3868 (arbitrary code execution)
Processing maliciously crafted web content may lead to arbitrary code
execution. Credit to Marcin Towalski of Cisco Talos.
A remote attacker can bypass security restrictions via universal cross-
site scripting or execute arbitrary code via crafted web content.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security