[ASA-202007-1] webkit2gtk: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-202007-1
=========================================

Severity: Critical
Date    : 2020-07-14
CVE-ID  : CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9806
          CVE-2020-9807 CVE-2020-9843 CVE-2020-9850 CVE-2020-13753
Package : webkit2gtk
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1203

Summary
=======

The package webkit2gtk before version 2.28.3-1 is vulnerable to
multiple issues including arbitrary code execution, cross-site
scripting and sandbox escape.

Resolution
==========

Upgrade to 2.28.3-1.

# pacman -Syu "webkit2gtk>=2.28.3-1"

The problems have been fixed upstream in version 2.28.3.

Workaround
==========

None.

Description
===========

- CVE-2020-9802 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

- CVE-2020-9803 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

- CVE-2020-9805 (cross-site scripting)

A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, where processing maliciously crafted web content may
lead to universal cross site scripting.

- CVE-2020-9806 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

- CVE-2020-9807 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

- CVE-2020-9843 (cross-site scripting)

An issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, where processing maliciously crafted web content may
lead to a cross site scripting attack.

- CVE-2020-9850 (arbitrary code execution)

A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, allowing a remote attacker to execute arbitrary code.

- CVE-2020-13753 (sandbox escape)

The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3,
failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl.
CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal,
which allows access outside the sandbox. TIOCSTI can be used to
directly execute commands outside the sandbox by writing to the
controlling terminal’s input buffer, similar to CVE-2017-5226.

Impact
======

A remote attacker might be able to trigger cross-site scripting, bypass
the sandbox and execute arbitrary code on the affected host.

References
==========

https://webkitgtk.org/security/WSA-2020-0006.html
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9802
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9803
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9805
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9806
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9807
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9843
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9850
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-13753
https://security.archlinux.org/CVE-2020-9802
https://security.archlinux.org/CVE-2020-9803
https://security.archlinux.org/CVE-2020-9805
https://security.archlinux.org/CVE-2020-9806
https://security.archlinux.org/CVE-2020-9807
https://security.archlinux.org/CVE-2020-9843
https://security.archlinux.org/CVE-2020-9850
https://security.archlinux.org/CVE-2020-13753
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20200729/8ffaa9e8/attachment.sig>