GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Sun Oct 15, 2017 6:26 am Post subject: [ GLSA 201710-14 ] WebKitGTK+ |
|
|
Gentoo Linux Security Advisory
Title: WebKitGTK+: Multiple Vulnerabilities (GLSA 201710-14)
Severity: normal
Exploitable: remote
Date: 2017-10-13
Bug(s): #626142
ID: 201710-14
Synopsis
Multiple vulnerabilities have been found in WebkitGTK+, the worst
of which may allow remote attackers to execute arbitrary code.
Background
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, offers
Webkit’s full functionality and is used on a wide range of systems.
Affected Packages
Package: net-libs/webkit-gtk
Vulnerable: < 2.16.6
Unaffected: >= 2.16.6
Architectures: All supported architectures
Description
Multiple vulnerabilities have been discovered in WebkitGTK+. Please
review the references below for details.
Impact
A remote attacker could execute arbitrary code, cause a Denial of
Service condition, bypass intended memory-read restrictions, conduct a
timing side-channel attack to bypass the Same Origin Policy, obtain
sensitive information, or spoof the address bar.
Workaround
There is no known workaround at this time.
Resolution
All WebKitGTK+ users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.16.6"
| Packages which depend on this library may need to be recompiled. Tools
such as revdep-rebuild may assist in identifying some of these packages.
References
CVE-2017-7006
CVE-2017-7011
CVE-2017-7012
CVE-2017-7018
CVE-2017-7019
CVE-2017-7020
CVE-2017-7030
CVE-2017-7034
CVE-2017-7037
CVE-2017-7038
CVE-2017-7039
CVE-2017-7040
CVE-2017-7041
CVE-2017-7042
CVE-2017-7043 |
|