[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJAmgfgpTF--5HsAaWrmWaoM5dHswtdNB2==gUdhSCiDYG6X+A@mail.gmail.com>
Date: Wed, 27 Oct 2021 09:02:02 -0400
From: Francis Perron <francis.perron@...pify.com>
To: oss-security@...ts.openwall.com
Cc: Carlos Alberto Lopez Perez <clopez@...lia.com>, security@...kit.org,
Alberto Garcia <berto@...lia.com>
Subject: Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
On Wed, Oct 27, 2021 at 12:09 AM Salvatore Bonaccorso <carnil@...ian.org> wrote:
>
> Hi,
>
> [dropping most other recipients]
>
> On Tue, Oct 26, 2021 at 08:05:36PM +0100, Carlos Alberto Lopez Perez wrote:
> > ------------------------------------------------------------------------
> > WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
> > ------------------------------------------------------------------------
> >
> > Date reported : October 26, 2021
> > Advisory ID : WSA-2021-0006
> > WebKitGTK Advisory URL : https://webkitgtk.org/security/WSA-2021-0006.html
> > WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2021-0006.html
> > CVE identifiers : CVE-2021-30846, CVE-2021-30848,
> > CVE-2021-30849, CVE-2021-30851,
> > CVE-2021-30858, CVE-2021-42762.
> >
> > Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.
> [...]
> > CVE-2021-30851
> > Versions affected: WebKitGTK and WPE WebKit before 2.34.0.
> > Credit to Samuel Groß of Google Project Zero.
> > Impact: Processing maliciously crafted web content may lead to code
> > execution. Description: A memory corruption vulnerability was
> > addressed with improved locking.
>
> CVE-2021-30851 seems to be REJECTED (cf.
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30851). Is
> there a typo in the CVE id for this one or did the CVE got rejected
> later on?
BCC'ing Samuel Groß
Salvatore -
I think 30851 was not issued, and it may have been a mistake here.
There was no other CVE issued as part of WSA-2021-0006 according to
the GitHub repo for the CVE program:
https://github.com/CVEProject/cvelist/search?q=wsa-2021-0006
if you need a CVE for this, Samuel may be able to sort this out with
the WebKit folks, who also seem to advertise 30851 on their security
advisory site: https://webkitgtk.org/security/WSA-2021-0006.html
Have a good Wednesday,
--
Francis Perron
Engineering Program Manager | Security Incident Response
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
