[ASA-202002-10] webkit2gtk: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-202002-10
==========================================

Severity: High
Date    : 2020-02-17
CVE-ID  : CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867
          CVE-2020-3868
Package : webkit2gtk
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1100

Summary
=======

The package webkit2gtk before version 2.26.4-1 is vulnerable to
multiple issues including arbitrary code execution, cross-site
scripting, sandbox escape, denial of service and same-origin policy
bypass.

Resolution
==========

Upgrade to 2.26.4-1.

# pacman -Syu "webkit2gtk>=2.26.4-1"

The problems have been fixed upstream in version 2.26.4.

Workaround
==========

None.

Description
===========

- CVE-2020-3862 (denial of service)

A malicious website may be able to cause a denial of service.

- CVE-2020-3864 (same-origin policy bypass)

A DOM object context may not have had a unique security origin.

- CVE-2020-3865 (sandbox escape)

A top-level DOM object context may have incorrectly been considered
secure.

- CVE-2020-3867 (cross-site scripting)

Processing maliciously crafted web content may lead to universal cross
site scripting.

- CVE-2020-3868 (arbitrary code execution)

Processing maliciously crafted web content may lead to arbitrary code
execution. Credit to Marcin Towalski of Cisco Talos.

Impact
======

A remote attacker can bypass security restrictions via universal cross-
site scripting or execute arbitrary code via crafted web content.

References
==========

https://webkitgtk.org/security/WSA-2020-0002.html
https://security.archlinux.org/CVE-2020-3862
https://security.archlinux.org/CVE-2020-3864
https://security.archlinux.org/CVE-2020-3865
https://security.archlinux.org/CVE-2020-3867
https://security.archlinux.org/CVE-2020-3868
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20200229/5e58587e/attachment.sig>