oss-security - WebKitGTK+ Security Advisory WSA-2017-0007

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6128ec04-31d7-6978-e1bd-41e70ef4cf7d@igalia.com>
Date: Fri, 25 Aug 2017 18:27:59 +0200
From: Carlos Alberto Lopez Perez <clopez@...lia.com>
To: webkit-gtk@...ts.webkit.org
Cc: security@...kit.org, distributor-list@...me.org,
 oss-security@...ts.openwall.com, bugtraq@...urityfocus.com
Subject: WebKitGTK+ Security Advisory WSA-2017-0007

------------------------------------------------------------------------
WebKitGTK+ Security Advisory                               WSA-2017-0007
------------------------------------------------------------------------

Date reported      : August 25, 2017
Advisory ID        : WSA-2017-0007
Advisory URL       : https://webkitgtk.org/security/WSA-2017-0007.html
CVE identifiers    : CVE-2017-1000121, CVE-2017-1000122.

Several vulnerabilities were discovered in WebKitGTK+.

CVE-2017-1000121
    Versions affected: WebKitGTK+ before 2.16.3.
    Credit to Nathan Crandall.
    Impact: Processing maliciously crafted input may lead to arbitrary
    code execution or application crash. Description: An input
    validation issue on the handling of UNIX IPC messages may allow an
    attacker to trigger an integer overflow. The issue was addressed
    through improved state management.

CVE-2017-1000122
    Versions affected: WebKitGTK+ before 2.16.3.
    Credit to Nathan Crandall.
    Impact: Processing maliciously crafted input may lead to application
    crash. Description: An input validation issue on the handling of
    UNIX IPC messages allows an attacker to trigger an application
    crash. The issue was addressed through improved state management.


We recommend updating to the last stable version of WebKitGTK+. It is
the best way of ensuring that you are running a safe version of
WebKitGTK+. Please check our website for information about the last
stable releases.

Further information about WebKitGTK+ Security Advisories can be found
at: https://webkitgtk.org/security.html

The WebKitGTK+ team,
August 25, 2017



Download attachment "signature.asc" of type "application/pgp-signature" (898 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.