oss-security - WebKitGTK+ Security Advisory WSA-2017-0005

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <743a5703-e206-9304-cb30-71c76cde9bef@igalia.com>
Date: Wed, 21 Jun 2017 20:18:39 +0200
From: Carlos Alberto Lopez Perez <clopez@...lia.com>
To: "webkit-gtk@...ts.webkit.org" <webkit-gtk@...ts.webkit.org>
Cc: security@...kit.org, distributor-list@...me.org,
 oss-security@...ts.openwall.com, bugtraq@...urityfocus.com
Subject: WebKitGTK+ Security Advisory WSA-2017-0005

------------------------------------------------------------------------
WebKitGTK+ Security Advisory                               WSA-2017-0005
------------------------------------------------------------------------

Date reported      : June 21, 2017
Advisory ID        : WSA-2017-0005
Advisory URL       : https://webkitgtk.org/security/WSA-2017-0005.html
CVE identifiers    : CVE-2017-2538, CVE-2017-2424.

Several vulnerabilities were discovered in WebKitGTK+.

CVE-2017-2538
    Versions affected: WebKitGTK+ before 2.16.4.
    Credit to Richard Zhu (fluorescence) working with Trend Micro's Zero
    Day Initiative.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: Multiple memory corruption
    issues were addressed with improved memory handling.

CVE-2017-2424
    Versions affected: WebKitGTK+ before 2.16.0.
    Credit to Paul Thomson (using the GLFuzz tool) of the Multicore
    Programming Group, Imperial College London.
    Impact: Processing maliciously crafted web content may result in the
    disclosure of process memory. Description: An information disclosure
    issue existed in the processing of OpenGL shaders. This issue was
    addressed through improved memory management.


We recommend updating to the last stable version of WebKitGTK+. It is
the best way of ensuring that you are running a safe version of
WebKitGTK+. Please check our website for information about the last
stable releases.

Further information about WebKitGTK+ Security Advisories can be found
at: https://webkitgtk.org/security.html

The WebKitGTK+ team,
June 21, 2017



Download attachment "signature.asc" of type "application/pgp-signature" (898 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.