WebKitGTK

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0006

2024-10-31T00:00:00+00:00

Date Reported: October 31, 2024 </li>
Advisory ID: WSA-2024-0006 </li>
CVE identifiers: CVE-2024-44185</a>, CVE-2024-44244</a>, CVE-2024-44296</a> </li> </ul>
Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2024-44185</a>

Versions affected: WebKitGTK and WPE WebKit before 2.46.0.</li>
Credit to Gary Kwong.</li>
Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved checks.</li>
WebKit Bugzilla: 276097</li> </ul> </li>

CVE-2024-44244</a>

Versions affected: WebKitGTK and WPE WebKit before 2.46.3.</li>
Credit to an anonymous researcher, Q1IQ (@q1iqF) and P1umer (@p1umer).</li>
Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A memory corruption issue was addressed with improved input validation.</li>
WebKit Bugzilla: 279780</li> </ul> </li>

CVE-2024-44296</a>

Versions affected: WebKitGTK and WPE WebKit before 2.46.3.</li>
Credit to Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India).</li>
Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: The issue was addressed with improved checks.</li>
WebKit Bugzilla: 278765</li> </ul> </li> </ul>
We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.
Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html</a> or wpewebkit.org/security</a>.

WebKitGTK 2.46.3 released!

2024-10-30T00:00:00+00:00

This is a bug fix release in the stable 2.46 series.
What's new in the WebKitGTK 2.46.3 release?</h3>

Flatten layers to a plane when preseve-3d style is set.</li>
Fix DuckDuckGo links by adding a user agent quirk.</li>
Fix several crashes and rendering issues.</li> </ul>
Thanks to all the contributors who made possible this release.

WebKitGTK 2.47.1 released!

2024-10-29T00:00:00+00:00

This is the first development release leading toward 2.48 series.
What's new in the WebKitGTK 2.47.1 release?</h3>

Flatten layers to a plane when preseve-3d style is set.</li>
Build GPU process by default, but keeping WebGL in the web process by default for now.</li>
Use DMA-BUF buffers for WebGL when available.</li>
Fix DuckDuckGo links by adding a user agent quirk.</li>
Make GStreamer GL sink handle DMA-BUF memory to replace the DMA-BUF sink.</li>
Fix several crashes and rendering issues.</li> </ul>
Thanks to all the contributors who made possible this release.

WebKitGTK 2.46.2 released!

2024-10-21T00:00:00+00:00

This is a bug fix release in the stable 2.46 series.
What's new in the WebKitGTK 2.46.2 release?</h3>

Own well-known bus name on a11y bus.</li>
Improve memory consumption when putImageData is used repeatedly on accelerated canvas.</li>
Disable cached web process suspension for now to prevent leaks.</li>
Improve text kerning with different combinations of antialias and hinting settings.</li>
Destroy all network sessions on process exit.</li>
Fix visible rectangle calculation when there are animations.</li>
Fix the build with ENABLE_NOTIFICATIONS=OFF.</li>
Fix the build with ENABLE_FULLSCREEN_API=OFF.</li>
Fix the build with ENABLE_WEB_AUDIO=OFF.</li>
Fix the build on ppc64le.</li>
Fix several crashes and rendering issues.</li> </ul>
Thanks to all the contributors who made possible this release.

What's new in WebKitGTK 2.46?

2024-10-04T00:00:00+00:00

A couple of weeks ago the WebKitGTK team released version 2.46 of the GTK</a> port of the WebKit</a> project. While 2.44 was a significant release (making GTK4 the default toolkit for WebKitGTK), once again 2.46 marks an important milestone for the project, with the introduction of the new Skia rendering backend. Let's have a look at what is new in this exciting release.
Skia replaces Cairo as the rendering backend</h3>
We announced</a> some time ago that a new rendering backend with Skia</a> was on the works and that it will eventually replace Cairo. This release series is the first where Skia is used, bringing important improvements in rendering and performance. Depending on hardware configurations, we have observed MotionMark</a> score improvements up to four times better (4x) on powerful desktops with discrete GPUs, and low-end laptops, using integrated GPUs, managing to double (2x) their scores.

Scores for WebKitGTK 2.46.1 running on Linux, AMD Epyc 7281 CPU with a Radeon RX 560 GPU.</figcaption> </figure>

Scores may vary!</summary>

Performance measurements are highly-dependant on the hardware where they run and how WebKit was built. The figures above are from one particular setup. The speedup that the switch to Skia will give you are expected to be, of course, different!
<h4>WebKit Build</h4> Clang is recommended by the Skia developers, so version 18.1.8 was used with <abbr title="Link-Time Optimization">LTO</abbr> optimization options, <abbr title="Identical Code Folding">ICF</abbr>, and <code>-march=x86-64-v3</code>. This is representative of common compiler options that packagers use. WebKitGTK was built from the <a href="https://webkitgtk.org/2024/09/30/webkitgtk2.46.1-released.html">official 2.46.1 release</a> tarball, using the following CMake invocation: </code></pre>OPT='-flto=thin -march=x86-64-v3' LDOPT='-flto=thin -Wl,-O1,--sort-common,--icf=safe' CC=clang \ CXX=clang++ \ CFLAGS="$OPT -fdata-sections -ffunction-sections" \ CXXFLAGS="$OPT -fdata-sections -ffunction-sections" \ LDFLAGS="$LDOPT -fuse-ld=lld -Wl,--gc-sections" \ cmake -Bbuilddir -DPORT=GTK \ -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_INSTALL_PREFIX=$HOME/.prefix/gtk4cairo -GNinja </pre> The same was used for the Cairo build, adding <code>-DUSE_SKIA=OFF</code>, and changing the installation path. <h4>Hardware</h4> The box used is a rather beefy desktop computer, although a few years old by now, which showed scores 3.8x better with Skia: <ul> <li>Dual AMD Epyc 7281 processor at 2.1 GHz (32 cores, 64 SMT threads).</li> <li>AMD Radeon RX 560 GPU with 4 GiB of video memory.</li> <li>128 GiB of system memory.</li> </ul> We also tested on an aging laptop with the following specifications, which achieved scores 2.65x better with Skia: <ul> <li>Intel Skylake Core i7-6600U processor at 2.6 GHz (2 cores, 4 SMT threads).</li> <li>Intel HD Graphics 520 integrated GPU.</li> <li>20 GiB of system memory.</li> </ul> The result from this second computer is the reason why we are confident that any reasonably recent desktop or laptop should get a good performance boost with this WebKitGTK release. </code></pre> </div> </details> The Cairo backend is still present and will be selected automatically at build time for big-endian architectures, where Skia is not yet supported. We plan to remove support for Cairo in the near future, and this approach allows us to ship the new renderer while solving the remaining issues. At any rate, the Cairo renderer is no longer receiving active development. It is important to notice that it is recommended to build WebKitGTK with Clang instead of GCC. This recommendation comes from upstream Skia; see their supported and preferred compilers page</a> for details. Revamped graphics stack</h3> Tha switch to Skia has made possible a significant number of changes and improvements in the WebKit graphics stack. These changes relate to accelerated canvas, accelerated CSS filters, color spaces, and more. Carlos García has written extensively about these changes</a> in his blog, we recommend reading his article for more details. Trace point profiling with sysprof</h3> Sysprof</a> is a profiling and performance analysis tool for Linux. Thanks to integration with the libsysprof-capture</code> library, it is now possible to use Sysprof to record trace points to do profiling and performance analysis of WebKit internals. This is a major improvement that will allow us to more effectively analyze the code paths that are more performance-sensitive and find ways to optimize them. It will also allow vendors to profile their specific hardware configurations and specific use-cases as well. For a more in-depth presentation of the integration with Sysprof, please read Georges Stavacras' blog post on the topic</a>. API changes</h3> Additions: webkit_settings_apply_from_key_file()</code></a> allows applying WebKit settings directly from a key file</li> The console message API, which had been previously deprecated, has been brought to the current API</li> WebKitAutomationSession::will-close</code></a> signal, which allows clients to perform cleanup tasks before an automation session is closed</li> enable-2d-canvas-acceleration</code></a> WebSetting can be used to control 2D-canvas acceleration in Skia-enabled builds</li> </ul> Deprecations: WebKitWebView::insecure-content-detected</code> signal.</li> WebKitWebContext:use-system-appearance-for-scrollbars</code> property.</li> webkit_web_context_set_use_system_appearance_for_scrollbars()</code> and webkit_web_context_get_use_system_appearance_for_scrollbars()</code>.</li> </ul> Changes: The non-standard HTMLDocument</code> functions width()</code> and height()</code> have been removed, so now the DOM API functions webkit_dom_html_document_get_width()</code> and webkit_dom_html_document_get_height()</code> always return zero. The DOM API has been deprecated for many years and the change is expected to have little impact.</li> </ul> Web Platform changes</h3> The changes to supported Web Platform features between releases of WebKit are always substantial, and for that reason listing all of those changes here would be a major endeavour. The following is an incomplete list of some of the features that have been enabled, removed, and marked in preview state since 2.44, in no particular order: CSS Container/Style Queries</li> CSS text-wrap-style</code></li> CSS background-clip: border-area</code></li> CSS text-underline-position: left|right</code></li> CSS scrollbar-width</code></li> CSS View Transitions</li> CSS Grid Masonry layout (preview)</li> CSS ::target-text</code> pseudo element</li> WebCrypto X25519 algorithm (preview)</li> AppCache support has been removed</li> New Promise.try()</code> method</li> New Observable</code> methods, like .map()</code> and .filter()</code></li> </ul> Other noteworthy changes</h3> Accelerated Compositing is now enabled by default in layout tests. Previously, AC mode would be enabled on-demand, and that behaviour can still be configured through the API.</li> The screensaver should not be triggered anymore when watching videos.</li> The Web Inspector gained support for loading JavaScript garbage collector snapshots for inspection.</li> Suport for the WebP image format is now always enabled.</li> WebDriver clients may now connect to an already running process, instead of always needing to spawn a new one.</li> The gst-libav</code> AAC decoders are now disabled due to outstanding bugs. Distributors are encouraged to use the GStreamer FDK AAC decoder (part of gst-plugins-bad</code>) instead.</li> </ul> On top of all of the above, there are countless bug fixes and improvements to WebKit, so many that it would be impossible to list them all here. For more details, you can always check the release notes for the 2.45.x release series from the news section</a> and the Git commit history. The WebKitGTK team is already working on 2.48, which will be even more awesome. Until then!
WebKitGTK 2.46.1 released! 2024-09-30T00:00:00+00:00 This is the first bug fix release in the stable 2.46 series. What's new in the WebKitGTK 2.46.1 release?</h3> Fix login QR code not shown in WhatsApp web.</li> Disable PSON by default again in GTK 3 API versions.</li> Disable DMABuf video sink by default to prevent file descriptor leaks.</li> Fix the build with GCC 13.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2024-0005 2024-09-25T00:00:00+00:00 Date Reported: September 25, 2024 </li> Advisory ID: WSA-2024-0005 </li> CVE identifiers: CVE-2024-23271</a>, CVE-2024-27808</a>, CVE-2024-27820</a>, CVE-2024-27833</a>, CVE-2024-27838</a>, CVE-2024-27851</a>, CVE-2024-40866</a>, CVE-2024-44187</a> </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2024-23271</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.5.</li> Credit to James Lee (@Windowsrcer).</li> Impact: A malicious website may cause unexpected cross-origin behavior. Description: A logic issue was addressed with improved checks.</li> WebKit Bugzilla: 265812</li> </ul> </li> CVE-2024-27808</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.2.</li> Credit to Lukas Bernhard of CISPA Helmholtz Center for Information Security.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> WebKit Bugzilla: 268221</li> </ul> </li> CVE-2024-27820</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.2.</li> Credit to Jeff Johnson of underpassapp.com.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> WebKit Bugzilla: 270139</li> </ul> </li> CVE-2024-27833</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.2.</li> Credit to Manfred Paul (@_manfp) working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An integer overflow was addressed with improved input validation.</li> WebKit Bugzilla: 271491</li> </ul> </li> CVE-2024-27838</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.3.</li> Credit to Emilio Cobos of Mozilla.</li> Impact: A maliciously crafted webpage may be able to fingerprint the user. Description: The issue was addressed by adding additional logic.</li> WebKit Bugzilla: 262337</li> </ul> </li> CVE-2024-27851</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.3.</li> Credit to Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: The issue was addressed with improved bounds checks.</li> WebKit Bugzilla: 272106</li> </ul> </li> CVE-2024-40866</a> Versions affected: WebKitGTK and WPE WebKit before 2.46.0.</li> Credit to Hafiizh and YoKo Kho (@yokoacc) of HakTrak.</li> Impact: Visiting a malicious website may lead to address bar spoofing. Description: The issue was addressed with improved UI.</li> WebKit Bugzilla: 279451</li> </ul> </li> CVE-2024-44187</a> Versions affected: WebKitGTK and WPE WebKit before 2.46.0.</li> Credit to Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India).</li> Impact: A malicious website may exfiltrate data cross-origin. Description: A cross- origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins.</li> WebKit Bugzilla: 279452</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html</a> or wpewebkit.org/security</a>. WebKitGTK 2.46.0 released! 2024-09-17T00:00:00+00:00 This is the first stable release in the 2.46 series. Highlights of the WebKitGTK 2.46.0 release</h3> Use Skia instead of cairo for 2D rendering and enable GPU rendering by default.</li> Enable offscreen canvas by default.</li> Add support for system tracing with Sysprof.</li> Implement printing using the Print portal.</li> Add new API to load settings from a config file.</li> Add a new setting to enable or disable the 2D canvas acceleration (enabled by default).</li> Undeprecate console messages API and make it available in 6.0 API.</li> </ul> For more details about all the changes included in WebKitGTK 2.46 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.44.4 released 2024-09-09T00:00:00+00:00 This is a bug fix release in the stable 2.44 series. What's new in WebKitGTK 2.44.4?</h3> Add quirk to allow totale.rosettastone.com</code> to load properly.</li> Fix webkit_web_resource_get_data()</code> not working properly in some sites.</li> Fix not being able to jump-to-source in Web Inspector canvas traces.</li> Fix not being able to scroll list of WebGL shader programs in the Web Inspector.</li> Fix linker relocation errors on Debug</code>/RelWithDebInfo</code> builds.</li> Fix crashes when built with Clang with Link-Time Optimization (LTO).</li> Fix several crashes and rendering issues.</li> </ul> Checksums</h4> webkitgtk-2.44.4.tar.xz (34.2 MiB) md5sum: fd031b34f22c09f91e97cca3a7dbc426 sha1sum: 3699ff9c9b84e755a0736e72dfd6e5a13151f7d6 sha256sum: 2ce4ec1b78413035037aba8326b31ed72696626b7bea7bace5e46ac0d8cbe796 </pre> WebKitGTK 2.45.92 released! 2024-09-02T00:00:00+00:00 This is a development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.92 release?</h3> Add webkit://gpu/stdout to dump the information from webkit://gpu to stdout.</li> Undeprecate injected bundle frame access interfaces.</li> Fix drag and drop.</li> Fix connection to a11y bus under flatpak.</li> Fix the build with Wayland and GBM disabled.</li> Fix the build in non-linux systems.</li> Fix linker relocation errors on Debug/RelWithDebInfo builds.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.45.91 released! 2024-08-26T00:00:00+00:00 This is a development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.91 release?</h3> Add new API to WebKitAutomationSession to be notified when the session is about to be closed.</li> Fix WebGL with accelerated compositing disabled.</li> Fix image filtering not being applied in some cases.</li> Fix the build on 32 bits systems.</li> Fix the build with -DUSE_TEXTURE_MAPPER_DMABUF=OFF</li> Fix several crashes and rendering issues.</li> Translatation updates: Slovenian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.45.90 released! 2024-08-19T00:00:00+00:00 This is a development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.90 release?</h3> Add explicit fencing support when available.</li> Use RGBA as the pixel format for texture backed SkSurfaces.</li> Fix build with gstreamer versions < 1.22.</li> Translatation updates: Slovenian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2024-0004 2024-08-16T00:00:00+00:00 Date Reported: August 17, 2024 </li> Advisory ID: WSA-2024-0004 </li> CVE identifiers: CVE-2024-40776</a>, CVE-2024-40779</a>, CVE-2024-40780</a>, CVE-2024-40782</a>, CVE-2024-40789</a>, CVE-2024-4558</a> </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2024-40776</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.3.</li> Credit to Huang Xilin of Ant Group Light-Year Security Lab.</li> Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.</li> WebKit Bugzilla: 273176</li> </ul> </li> CVE-2024-40779</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.3.</li> Credit to Huang Xilin of Ant Group Light-Year Security Lab.</li> Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: An out-of-bounds read was addressed with improved bounds checking.</li> WebKit Bugzilla: 275431</li> </ul> </li> CVE-2024-40780</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.3.</li> Credit to Huang Xilin of Ant Group Light-Year Security Lab.</li> Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: An out-of-bounds read was addressed with improved bounds checking.</li> WebKit Bugzilla: 275273</li> </ul> </li> CVE-2024-40782</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.3.</li> Credit to Maksymilian Motyl.</li> Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.</li> WebKit Bugzilla: 268770</li> </ul> </li> CVE-2024-40789</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.3.</li> Credit to Seunghyun Lee (@0x10n) of KAIST Hacking Lab working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: An out-of-bounds access issue was addressed with improved bounds checking.</li> </ul> </li> CVE-2024-4558</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.3.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: Use after free in ANGLE allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.</li> WebKit Bugzilla: 274165</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html</a> or wpewebkit.org/security</a>. WebKitGTK 2.44.3 released! 2024-08-13T00:00:00+00:00 This is a bug fix release in the stable 2.44 series. What's new in the WebKitGTK 2.44.3 release?</h3> Fix web process cache suspend/resume when sandbox is enabled.</li> Fix accelerated images dissapearing after scrolling.</li> Fix video flickering with DMA-BUF sink.</li> Fix pointer lock on X11.</li> Fix movement delta on mouse events in GTK3.</li> Undeprecate console message API and make it available in 2022 API.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.45.6 released! 2024-07-29T00:00:00+00:00 This is a development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.6 release?</h3> Fix web process cache suspend/resume when sandbox is enabled.</li> Use server wait instead of client wait for GL fences when possible.</li> Avoid unnecessary composition when layer didn't change even if a request animation frame is scheduled.</li> Improve pointer lock on X11.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.45.5 released! 2024-07-12T00:00:00+00:00 This is a development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.5 release?</h3> Add support for system tracing with Sysprof.</li> Allow receiving event listener signals from the a11y bus.</li> Fix pointer lock on X11.</li> Fix source links in generated API documentation.</li> Fix drawing shadows in some cases when ImageBitmap is accelerated.</li> Fix the build with MEDIA_STREAM disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.45.4 released! 2024-06-25T00:00:00+00:00 This is a development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.4 release?</h3> Enable offscreen canvas by default in production builds too.</li> Fix video flickering with DMA-BUF sink.</li> Fix movement delta on mouse events in GTK3.</li> Fix accelerated images dissapearing after scrolling.</li> Bubblewrap sandbox no longer kills auxiliary process when UI process terminates.</li> Fix rendering of shadows with several compositing operators.</li> Implement FEDropShadow and FEComponentTransfer filters using Skia.</li> Undeprecate webkit_back_forward_list_item_get_title().</li> Undeprecate console message API and make it available in 2022 API.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.45.3 released! 2024-05-28T00:00:00+00:00 This is a development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.3 release?</h3> Enable offscreen canvas by default.</li> Enable ImageBitmap acceleration.</li> Add support for accelerated offscreen canvas.</li> Do not display WebGL front buffer before it's initialized.</li> Fix text scaling.</li> Add a new setting to enable or disable the 2D canvas acceleration (enabled by default).</li> Deprecate WebKitWebContext:use-system-appearance-for-scrollbars property.</li> Undeprecate and document webkit_print_operation_print() behavior.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2024-0003 2024-05-21T00:00:00+00:00 Date Reported: May 21, 2024 </li> Advisory ID: WSA-2024-0003 </li> CVE identifiers: CVE-2024-27834</a> </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2024-27834</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.2.</li> Credit to Manfred Paul working with Trend Micro's Zero Day Initiative.</li> Impact: An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Description: The issue was addressed with improved checks.</li> WebKit Bugzilla: 272750</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html</a> or wpewebkit.org/security</a>. WebKitGTK 2.44.2 released! 2024-05-16T00:00:00+00:00 This is a bug fix release in the stable 2.44 series. What's new in the WebKitGTK 2.44.2 release?</h3> Make gamepads visible on axis movements, and not only on button presses.</li> Disable the gst-libav AAC decoder.</li> Make user scripts and style sheets visible in the Web Inspector.</li> Use the geolocation portal where available, with the existing geoclue as fallback if the portal is not usable.</li> Use the printing portal when running sandboxed.</li> Use the file transfer portal for drag and drop when running sandboxed.</li> Avoid notifying an empty cursor rectangle to input methods.</li> Remove empty bar shown in detached inspector windows.</li> Consider keycode when activating application accelerators.</li> Fix the build with ENABLE_WEBAUDIO disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.45.2 released! 2024-05-14T00:00:00+00:00 This is a development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.2 release?</h3> Use cairo on big-endian for now, since skia doesn't support it.</li> Fix a crash in GIF image decoder.</li> Revert the text scaling fix, since it caused several issues in some sites.</li> Add new API to load settings from a config file.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.45.1 released! 2024-05-10T00:00:00+00:00 This is the first development release leading toward 2.46 series. What's new in the WebKitGTK 2.45.1 release?</h3> Use skia instead of cairo for rendering.</li> Sync WebGL content with fences when available.</li> Implement printing using the Print portal.</li> Disable the gst-libav aac decoder.</li> Fix text scaling.</li> Consider keycode when activating application accelerators.</li> Support AXActiveElement and AXSelectedChildren for comboboxes, lists and listboxes.</li> Avoid notifying an empty cursor rectangle to input methods.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.44.1 released! 2024-04-09T00:00:00+00:00 This is the first bug fix release in the stable 2.44 series. What's new in the WebKitGTK 2.44.1 release?</h3> Fix handling of lifetime of web view child dialogs in GTK4.</li> Do not schedule layer flushes when drawing area size is empty.</li> Fix videos with alpha when using the DMA-BUF sink.</li> Fix the build with USE_GBM=OFF.</li> Fix the build in 32bit platforms</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. What's new in WebKitGTK 2.44? 2024-03-27T00:00:00+00:00 Last week, the WebKitGTK team released version 2.44 of the GTK port of the WebKit project. This release is an important milestone for the project as it's the first in which GTK4 is the default toolkit. Let's have a look to what's new in this new release. GTK4 is now used by default</h3> While the GTK4 API has been stable for about a year now</a>, and the development releases leading up to 2.44 have already been building with GTK4 support by default, this is the first stable release that features GTK4 prominently. The GTK3 API is still available, and it's possible to parallel-install WebKitGTK targetting both libraries, but we encourage everyone to start migrating to the new API, testing it, and to report any issues you might find</a>. Improved accessibility support with GTK4</h3> One of the main missing pieces for accessibility in the GTK4 port was being able to connect the accessibility tree for the web content to the rest of the hierarchy exposed by GTK4 to accessibility technologies. During this cycle Georges Stavracas</a> coordinated with the GTK developers to add new API that WebKitGTK now uses to expose the accessibility tree of the web content. While there are still improvements to be made, fixing this unblocks further developments. The existing accesibility support for GTK3 continues to work as before. WebKit's DisplayLink support</h3> DisplayLink is a WebCore feature that improves resource utilization and improves synchronization with vertical screen retrace. For 2.44, an implementation of this feature for the GTK port was added that improves rendering performance. Improved hardware-acceleration video decoding and rendering</h3> When WebKit is using GStreamer 1.24 or newer, video playback can use the new support for DRM modifiers in the DMA-BUF sink. This improves video decoding and rendering, as it allows for zero-copy negotiation with the video decoders. WebCodec API supported</h3> WebKitGTK now supports the WebCodecs API</a>, which allows web developers low-level access to video frames and audio chunks, a feature of importance for multimedia applications that need finer grain control over what gets played on the browser. Other noteworthy changes</h3> Rendering with the Vulkan GTK renderer, which was known to have issues, is now working correctly.</li> The X11 and WPE renderers have been removed in favor of the DMA-BUF one. This means that WPE related dependencies are no longer needed.</li> Support for the JPEG2000 image format has been removed. WebKit was the only major engine still supporting the format, which these days is rarely used. As a consequence, OpenJPEG is no longer a dependency. JPEG2000 should not be confused with JPEG-XL, which is still supported.</li> Event reinjection has been removed. This might require changes in applications that use keybindings and such. GNOME Web has been updated already</a> for the GNOME 46 release.</li> Many memory and stability improvements, particularly on the multimedia backends.</li> </ul> For a more detailed list of changes, please check the release notes for 2.43.x and 2.44.0 from the news section</a>. WebKitGTK and WPE WebKit Security Advisory WSA-2024-0002 2024-03-26T00:00:00+00:00 Date Reported: March 26, 2024 </li> Advisory ID: WSA-2024-0002 </li> CVE identifiers: CVE-2024-23252</a>, CVE-2024-23254</a>, CVE-2024-23263</a>, CVE-2024-23280</a>, CVE-2024-23284</a>, CVE-2023-42950</a>, CVE-2023-42956</a>, CVE-2023-42843</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2024-23252</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> Credit to anbu1024 of SecANT.</li> Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.</li> WebKit Bugzilla: 263758</li> </ul> </li> CVE-2024-23254</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> Credit to James Lee (@Windowsrcer).</li> Impact: A malicious website may exfiltrate audio data cross-origin. Description: The issue was addressed with improved UI handling.</li> WebKit Bugzilla: 263795</li> </ul> </li> CVE-2024-23263</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> Credit to Johan Carlsson (joaxcar).</li> Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved validation.</li> WebKit Bugzilla: 264811</li> </ul> </li> CVE-2024-23280</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> Credit to An anonymous researcher.</li> Impact: A maliciously crafted webpage may be able to fingerprint the user. Description: An injection issue was addressed with improved validation.</li> WebKit Bugzilla: 266703</li> </ul> </li> CVE-2024-23284</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> Credit to Georg Felber and Marco Squarcina.</li> Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved state management.</li> WebKit Bugzilla: 267241</li> </ul> </li> CVE-2023-42950</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> Credit to Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute and rushikesh nandedkar.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> WebKit Bugzilla: 263682</li> </ul> </li> CVE-2023-42956</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> Credit to SungKwon Lee (Demon.Team).</li> Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.</li> WebKit Bugzilla: 263989</li> </ul> </li> CVE-2023-42843</a> Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> Credit to Kacper Kwapisz (@KKKas_).</li> Impact: Visiting a malicious website may lead to address bar spoofing. Description: An inconsistent user interface issue was addressed with improved state management.</li> WebKit Bugzilla: 260046</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.44.0 released! 2024-03-16T00:00:00+00:00 This is the first stable release in the 2.44 series. Highlights of the WebKitGTK 2.44.0 release</h3> Make the DOM accessibility tree reachable from UI process with GTK4.</li> Removed the X11 and WPE renderers in favor of DMA-BUF.</li> Improved vblank synchronization when rendering.</li> Removed key event reinjection in GTK4 to make keyboard shortcuts work in web sites.</li> Fix gamepads detection by correctly handling focused window in GTK4.</li> </ul> For more details about all the changes included in WebKitGTK 2.44 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.42.5 released! 2024-02-05T00:00:00+00:00 This is a bug fix release in the stable 2.42 series. What's new in the WebKitGTK 2.42.5 release?</h3> Fix webkit_web_context_allow_tls_certificate_for_host to handle IPv6 URIs produced by SoupURI.</li> Ignore stops with offset zero before last one when rendering gradients with cairo.</li> Write bwrapinfo.json to disk for xdg-desktop-portal.</li> Fix gamepads detection by correctly handling focused window in GTK4.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001 2024-02-05T00:00:00+00:00 Date Reported: February 05, 2024 </li> Advisory ID: WSA-2024-0001 </li> CVE identifiers: CVE-2024-23222</a>, CVE-2024-23213</a>, CVE-2023-40414</a>, CVE-2023-42833</a>, CVE-2014-1745</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2024-23222</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.5.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks.</li> WebKit Bugzilla: 267134</li> </ul> </li> CVE-2024-23213</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.5.</li> Credit to Wangtaiyu of Zhongfu info.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> WebKit Bugzilla: 266619</li> </ul> </li> CVE-2023-40414</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.1.</li> Credit to Francisco Alonso (@revskills).</li> Impact: Processing web content may lead to arbitrary code execution. Description: A use-after-free issue was addressed with improved memory management.</li> WebKit Bugzilla: 258992</li> </ul> </li> CVE-2023-42833</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.0.</li> Credit to Dong Jun Kim (@smlijun) and Jong Seong Kim (@nevul37) of AbyssLab.</li> Impact: Processing web content may lead to arbitrary code execution. Description: A correctness issue was addressed with improved checks.</li> WebKit Bugzilla: 258592</li> </ul> </li> CVE-2014-1745</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.0.</li> Credit to An anonymous researcher.</li> Impact: Processing a file may lead to a denial-of-service or potentially disclose memory contents. Description: The issue was addressed with improved checks.</li> WebKit Bugzilla: 249434</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.43.4 released! 2024-02-02T00:00:00+00:00 This is a development release leading toward 2.44 series. What's new in the WebKitGTK 2.43.4 release?</h3> Remove key event reinjection in GTK4 to make keyboard shortcuts work in web sites.</li> Use the new GTK API to create a GdkTexture from a DMA-BUF buffer when available.</li> Fix rendering when GTK is using the vulkan renderer.</li> Fix gamepads detection by correctly handling focused window in GTK4.</li> Fix rendering after history navigation.</li> Write bwrapinfo.json to disk for xdg-desktop-portal.</li> Fixed several memory leaks in media backend.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.43.3 released! 2023-12-21T00:00:00+00:00 This is a development release leading toward 2.44 series. What's new in the WebKitGTK 2.43.3 release?</h3> Show vblank monitor information in webkit://gpu.</li> Fallback to timer based vblank monitor if drmWaitVBlank fails.</li> Fix several memory leaks in media backend.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0012 2023-12-18T00:00:00+00:00 Date Reported: December 18, 2023 </li> Advisory ID: WSA-2023-0012 </li> CVE identifiers: CVE-2023-42883</a>, CVE-2023-42890</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-42883</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.4.</li> Credit to Zoom Offensive Security Team.</li> Impact: Processing a SVG image may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.</li> WebKit Bugzilla: 263349</li> </ul> </li> CVE-2023-42890</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.0.</li> Credit to Pwn2car.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> WebKit Bugzilla: 259830</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.42.4 released! 2023-12-15T00:00:00+00:00 This is a bug fix release in the stable 2.42 series. What's new in the WebKitGTK 2.42.4 release?</h3> Fix incorrect random images incorrectly displayed as backgrounds of elements.</li> Fix videos displayed aliased after being resized e.g. in YouTube.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.42.3 released! 2023-12-05T00:00:00+00:00 This is a bug fix release in the stable 2.42 series. What's new in the WebKitGTK 2.42.3 release?</h3> Fix flickering while playing videos with DMA-BUF sink.</li> Fix color picker being triggered in the inspector when typing "tan".</li> Do not special case the "sans" font family name.</li> Fix build failure with libxml2 version 2.12.0 due to an API change.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0011 2023-12-05T00:00:00+00:00 Date Reported: December 05, 2023 </li> Advisory ID: WSA-2023-0011 </li> CVE identifiers: CVE-2023-42916</a>, CVE-2023-42917</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-42916</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.3.</li> Credit to Clément Lecigne of Google's Threat Analysis Group.</li> Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds read was addressed with improved input validation.</li> WebKit Bugzilla: 265041</li> </ul> </li> CVE-2023-42917</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.3.</li> Credit to Clément Lecigne of Google's Threat Analysis Group.</li> Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A memory corruption vulnerability was addressed with improved locking.</li> WebKit Bugzilla: 265067</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.43.2 released! 2023-12-04T00:00:00+00:00 This is a development release leading toward 2.44 series. What's new in the WebKitGTK 2.43.2 release?</h3> Remove the X11 and WPE renderers.</li> Release unused buffers when the view is hidden.</li> Fix flickering while playing videos with DMA-BUF sink.</li> Do not special case the "sans" font family name.</li> Fix webkit_web_context_allow_tls_certificate_for_host() for IPv6 URIs produced by SoupURI.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.43.1 released! 2023-11-17T00:00:00+00:00 This is the first development release leading toward 2.44 series. What's new in the WebKitGTK 2.43.1 release?</h3> Improve vblank synchronization when rendering.</li> Improve DMA-BUF buffers handling for video frames.</li> Use the buffer format preferred by the driver in DMA-BUF renderer.</li> Do not block the compositing thread waiting for rendering threads.</li> Improve performance when scaling images in a canvas.</li> Fix several crashes and rendering issues.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0010 2023-11-15T00:00:00+00:00 Date Reported: November 15, 2023 </li> Advisory ID: WSA-2023-0010 </li> CVE identifiers: CVE-2022-32919</a>, CVE-2022-32933</a>, CVE-2022-46705</a>, CVE-2022-46725</a>, CVE-2023-32359</a>, CVE-2023-41983</a>, CVE-2023-42852</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-32919</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.4.</li> Credit to @real_as3617.</li> Impact: Visiting a website that frames malicious content may lead to UI spoofing. Description: The issue was addressed with improved UI handling.</li> WebKit Bugzilla: 247461</li> </ul> </li> CVE-2022-32933</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.0.</li> Credit to Binoy Chitale, MS student, Stony Brook University, Nick Nikiforakis, Associate Professor, Stony Brook University, Jason Polakis, Associate Professor, University of Illinois at Chicago, Mir Masood Ali, PhD student, University of Illinois at Chicago, Chris Kanich, Associate Professor, University of Illinois at Chicago, and Mohammad Ghasemisharif, PhD Candidate, University of Illinois at Chicago.</li> Impact: A website may be able to track the websites a user visited in private browsing mode. Description: An information disclosure issue was addressed by removing the vulnerable code.</li> WebKit Bugzilla: 239547</li> </ul> </li> CVE-2022-46705</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.4.</li> Credit to Hyeon Park (@tree_segment) of Team ApplePIE.</li> Impact: Visiting a malicious website may lead to address bar spoofing. Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.</li> WebKit Bugzilla: 247287</li> </ul> </li> CVE-2022-46725</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.4.</li> Credit to Hyeon Park (@tree_segment) of Team ApplePIE.</li> Impact: Visiting a malicious website may lead to address bar spoofing. Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.</li> WebKit Bugzilla: 247289</li> </ul> </li> CVE-2023-32359</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.0.</li> Credit to Claire Houston.</li> Impact: A user's password may be read aloud by a text-to-speech accessibility feature. Description: This issue was addressed with improved redaction of sensitive information.</li> WebKit Bugzilla: 248717</li> </ul> </li> CVE-2023-41983</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.2.</li> Credit to 이준성(Junsung Lee).</li> Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.</li> WebKit Bugzilla: 260757</li> </ul> </li> CVE-2023-42852</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.2.</li> Credit to Pedro Ribeiro (@pedrib1337) and Vitor Pedreira (@0xvhp_) of Agile Information Security.</li> Impact: Processing web content may lead to arbitrary code execution. Description: A logic issue was addressed with improved checks.</li> WebKit Bugzilla: 260173</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.42.2 released! 2023-11-10T00:00:00+00:00 This is a bug fix release in the stable 2.42 series. What's new in the WebKitGTK 2.42.2 release?</h3> Bump Safari version in user agent header.</li> Fix CSP regression that broke Unity WebGL applications.</li> Fix the build with GBM disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0009 2023-09-28T00:00:00+00:00 Date Reported: September 28, 2023 </li> Advisory ID: WSA-2023-0009 </li> CVE identifiers: CVE-2023-35074</a>, CVE-2023-39928</a>, CVE-2023-40451</a>, CVE-2023-41074</a>, CVE-2023-41993</a> </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-35074</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.0.</li> Credit to Abysslab Dong Jun Kim(@smlijun) and Jong Seong Kim(@nevul37).</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> </ul> </li> CVE-2023-39928</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.0.</li> Credit to Marcin 'Icewall' Noga of Cisco Talos.</li> A use-after-free vulnerability exists in the MediaRecorder API of the WebKit GStreamer-based ports (WebKitGTK and WPE WebKit). A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability. WebKit Bugzilla: 260649.</li> </ul> </li> CVE-2023-40451</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to an anonymous researcher.</li> Impact: An attacker with JavaScript execution may be able to execute arbitrary code. Description: This issue was addressed with improved iframe sandbox enforcement.</li> </ul> </li> CVE-2023-41074</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.0.</li> Credit to 이준성(Junsung Lee) of Cross Republic and me Li.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved checks.</li> </ul> </li> CVE-2023-41993</a> Versions affected: WebKitGTK and WPE WebKit before 2.42.1.</li> Credit to Bill Marczak of The Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group.</li> Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: The issue was addressed with improved checks.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html</a> or wpewebkit.org/security</a>. WebKitGTK 2.42.1 released! 2023-09-27T00:00:00+00:00 This is the first bug fix release in the stable 2.42 series. What's new in the WebKitGTK 2.42.1 release?</h3> Fix enable-html5-database setting to properly enable/disable IndexedDB API.</li> Fix the build with GBM disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.42.0 released! 2023-09-15T00:00:00+00:00 This is the first stable release in the 2.42 series. Highlights of the WebKitGTK 2.42.0 release</h3> New renderer based on DMA-BUF shared buffers.</li> Add new permission request to handle DOM paste access requests.</li> Add API to configure experimental features at runtime.</li> Add API to set the percentage of volume space that can be used for data storage.</li> GBM is no longer required for WebGL implementation.</li> </ul> For more details about all the changes included in WebKitGTK 2.42 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0008 2023-09-11T00:00:00+00:00 Date Reported: September 11, 2023 </li> Advisory ID: WSA-2023-0008 </li> CVE identifiers: CVE-2023-28198</a>, CVE-2023-32370</a>, CVE-2023-40397</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-28198</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.1.</li> Credit to hazbinhotel working with Trend Micro Zero Day Initiative.</li> Impact: Processing web content may lead to arbitrary code execution. Description: A use-after-free issue was addressed with improved memory management.</li> </ul> </li> CVE-2023-32370</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.1.</li> Credit to Gertjan Franken of imec-DistriNet, KU Leuven.</li> Impact: Content Security Policy to block domains with wildcards may fail. Description: A logic issue was addressed with improved validation.</li> </ul> </li> CVE-2023-40397</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to Johan Carlsson (joaxcar).</li> Impact: A remote attacker may be able to cause arbitrary javascript code execution. Description: The issue was addressed with improved checks.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.41.92 released! 2023-09-08T00:00:00+00:00 This is a development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.92 release?</h3> Fix render updates after cross origin history navigation with GTK4.</li> Fix flickering in non accelerated compositing mode.</li> Fix pixelated accelerated blur filter.</li> Fix web process launching when xdg-dbus-proxy is not installed.</li> Pass GBM_BO_USE_RENDERING to gbm_bo_create.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.41.91 released! 2023-08-19T00:00:00+00:00 This is a development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.91 release?</h3> Properly handle toplevel window state changes in GTK4.</li> Do not keep processing frames while the view is unrealized when using DMA-BUF renderer.</li> Fallback to first render node returned by DRM when failing to get using EGLDevice.</li> Fix the build with libjxl < 0.7.0.</li> Fix several crashes and rendering issues.</li> Translation updates: Turkish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.41.90 released! 2023-08-10T00:00:00+00:00 This is a development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.90 release?</h3> Fix the popup menu always shown in github when logged in.</li> Add API to replace and retrieve the entire cookie jar.</li> Apply the device scale factor when changed after web view is created.</li> Do not expose media devices that can't be used in enumerateDevices.</li> Add support for P010 video format.</li> Fix non-accelerated rendering that broke web inspector.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0007 2023-08-02T00:00:00+00:00 Date Reported: August 02, 2023 </li> Advisory ID: WSA-2023-0007 </li> CVE identifiers: CVE-2023-38133</a>, CVE-2023-38572</a>, CVE-2023-38592</a>, CVE-2023-38594</a>, CVE-2023-38595</a>, CVE-2023-38597</a>, CVE-2023-38599</a>, CVE-2023-38600</a>, CVE-2023-38611</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-38133</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to YeongHyeon Choi (@hyeon101010).</li> Impact: Processing web content may disclose sensitive information. Description: The issue was addressed with improved checks.</li> </ul> </li> CVE-2023-38572</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to Narendra Bhati (twitter.com/imnarendrabhati) of Suma Soft Pvt. Ltd, Pune - India.</li> Impact: A website may be able to bypass Same Origin Policy. Description: The issue was addressed with improved checks.</li> </ul> </li> CVE-2023-38592</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to Narendra Bhati (twitter.com/imnarendrabhati) of Suma Soft Pvt. Ltd, Pune - India, Valentino Dalla Valle, Pedro Bernardo, Marco Squarcina, and Lorenzo Veronese of TU Wien.</li> Impact: Processing web content may lead to arbitrary code execution. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2023-38594</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to Yuhao Hu.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved checks.</li> </ul> </li> CVE-2023-38595</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to an anonymous researcher, Jiming Wang, and Jikai Ren.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved checks.</li> </ul> </li> CVE-2023-38597</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to 이준성(Junsung Lee) of Cross Republic.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved checks.</li> </ul> </li> CVE-2023-38599</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to Hritvik Taneja, Jason Kim, Jie Jeff Xu, Stephan van Schaik, Daniel Genkin, and Yuval Yarom.</li> Impact: A website may be able to track sensitive user information. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2023-38600</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to Anonymous working with Trend Micro Zero Day Initiative.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved checks.</li> </ul> </li> CVE-2023-38611</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.5.</li> Credit to Francisco Alonso (@revskills).</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.40.5 released! 2023-08-01T00:00:00+00:00 This is a bug fix release in the stable 2.40 series. What's new in the WebKitGTK 2.40.5 release?</h3> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.40.4 released! 2023-07-21T00:00:00+00:00 This is a bug fix release in the stable 2.40 series. What's new in the WebKitGTK 2.40.4 release?</h3> Fix a bug in JavaScript reading variable arguments in a call.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0006 2023-07-21T00:00:00+00:00 Date Reported: July 21, 2023 </li> Advisory ID: WSA-2023-0006 </li> CVE identifiers: CVE-2023-37450</a>, CVE-2023-32393</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-37450</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.4.</li> Credit to an anonymous researcher.</li> Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: The issue was addressed with improved checks.</li> </ul> </li> CVE-2023-32393</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.0.</li> Credit to Francisco Alonso (@revskills).</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.41.6 released! 2023-07-04T00:00:00+00:00 This is a development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.6 release?</h3> Add API to set the percentage of volume space that can be used for data storage.</li> Do not use GBM and DMA-BUF for WebGL implementation.</li> Use EGL_MESA_image_dma_buf_export if available when GBM is disabled.</li> Fix AV1 video with the dav1d decoder when using the DMA-BUF sink.</li> Use three buffers for DMA-BUF renderer.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0005 2023-06-29T00:00:00+00:00 Date Reported: June 29, 2023 </li> Advisory ID: WSA-2023-0005 </li> CVE identifiers: CVE-2022-48503</a>, CVE-2023-32435</a>, CVE-2023-32439</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-48503</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.0.</li> Credit to Dongzhuo Zhao working with ADLab of Venustech, and ZhaoHai of Cyberpeace Tech Co., Ltd.</li> Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved bounds checks.</li> </ul> </li> CVE-2023-32435</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.0.</li> Credit to Georgy Kucherin (@kucher1n), Leonid Bezvershenko (@bzvr_), and Boris Larin (@oct0xor) of Kaspersky.</li> Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2023-32439</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.3.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A type confusion issue was addressed with improved checks.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.40.3 released! 2023-06-28T00:00:00+00:00 This is a bug fix release in the stable 2.40 series. What's new in the WebKitGTK 2.40.3 release?</h3> Make memory pressure monitor honor memory.memsw.usage_in_bytes if exists.</li> Include key modifiers in wheel events.</li> Apply cookie blocking policy to WebSocket handshakes.</li> Remove accidental dependency on GLib 2.70.</li> Fix the build with BUBBLEWRAP_SANDBOX disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.41.5 released! 2023-06-13T00:00:00+00:00 This is a development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.5 release?</h3> Include key modifiers in wheel events.</li> Remove support for OpenGL API in the web process.</li> Native DASH support is now opt-in, like HLS.</li> Fix scrollbar jumping to top when drag released outside window in GTK4.</li> Fix contents not rendered in new web view when realized after configure and frame with DMA-BUF renderer.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0004 2023-05-30T00:00:00+00:00 Date Reported: May 30, 2023 </li> Advisory ID: WSA-2023-0004 </li> CVE identifiers: CVE-2023-28204</a>, CVE-2023-32373</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-28204</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.2.</li> Credit to an anonymous researcher.</li> Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds read was addressed with improved input validation.</li> </ul> </li> CVE-2023-32373</a> Versions affected: WebKitGTK and WPE WebKit before 2.40.2.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use-after-free issue was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.40.2 released! 2023-05-29T00:00:00+00:00 This is a bug fix release in the stable 2.40 series. What's new in the WebKitGTK 2.40.2 release?</h3> Fix scrollbar jumping to top when drag released outside window in GTK4.</li> Fix video rendering when GL is disabled.</li> Fix flickering on looped videos when starting again.</li> Fix CPU usage on autoplaying videos.</li> Choose amount of painting threads depending on available CPU cores on GTK4.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.41.4 released! 2023-05-17T00:00:00+00:00 This is a development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.4 release?</h3> Add new API to configure experimental features at runtime.</li> Add support for prefers-reduced-motion media query.</li> Split hardware acceleration information in webkit://gpu.</li> Fix CPU usage on autoplaying videos.</li> Fix video rendering when GL is disabled.</li> Choose amount of painting threads depending on available CPU cores on GTK4.</li> Add memory usage of images in web inspector memory timeline.</li> Fix the build with X11 target disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.41.3 released! 2023-04-21T00:00:00+00:00 This is a development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.3 release?</h3> Ensure the same GPU device is used by GBM in all processes.</li> Fix memory corruption causing glitches in several web sites.</li> Use more reliable generated application ID.</li> Show DRM device and render node files when available in webkit://gpu.</li> Fix the build on i386.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003 2023-04-21T00:00:00+00:00 Date Reported: April 21, 2023 </li> Advisory ID: WSA-2023-0003 </li> CVE identifiers: CVE-2023-25358</a>, CVE-2022-0108</a>, CVE-2022-32885</a>, CVE-2023-27932</a>, CVE-2023-27954</a>, CVE-2023-28205</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-25358</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.8.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> A use-after-free vulnerability exists in WebCore::RenderLayer. This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. This is the same issue as CVE-2023-25360, CVE-2023-25361, CVE-2023-25362 and CVE-2023-25363.</li> </ul> </li> CVE-2022-0108</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.6 and 2.40 branch before 2.40.1.</li> Credit to Luan Herrera (@lbherrera_).</li> Impact: An HTML document may be able to render iframes with sensitive user information. Description: This issue was addressed with improved iframe sandbox enforcement.</li> </ul> </li> CVE-2022-32885</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.6 and 2.40 branch before 2.40.1.</li> Credit to P1umer(@p1umer) and Q1IQ(@q1iqF).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved validation.</li> </ul> </li> CVE-2023-27932</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.6 and 2.40 branch before 2.40.1.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may bypass Same Origin Policy. Description: This issue was addressed with improved state management.</li> </ul> </li> CVE-2023-27954</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.6 and 2.40 branch before 2.40.1.</li> Credit to an anonymous researcher.</li> Impact: A website may be able to track sensitive user information. Description: The issue was addressed by removing origin information.</li> </ul> </li> CVE-2023-28205</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.6 and 2.40 branch before 2.40.1.</li> Credit to Clément Lecigne of Google's Threat Analysis Group and Donncha Ó Cearbhaill of Amnesty International’s Security Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.38.6 released! 2023-04-20T00:00:00+00:00 This is a bug fix release in the stable 2.38 series. What's new in the WebKitGTK 2.38.6 release?</h3> Enable the Asynchronous Clipboard API to make certain pages work (e.g. GithHub started recently requiring it).</li> Support :has() CSS selectors in content filters.</li> Apply basic font properties as font variation settings.</li> The Bubblewrap sandbox no longer requires setting an application identifier via GApplication to operate correctly. Using GApplication is still recommended, but optional.</li> Improvements to the GStreamer multimedia playback, in particular around MSE, WebRTC, and seeking.</li> Fix the build with journald support enabled when using elogind instead of the systemd libraries.</li> Fix the build with Link-Time Optimization enabled (-flto=auto).</li> Fix context menus not working in the remote Web Inspector.</li> Fix usage of the remote Web Inspector over HTTP.</li> Fix debug logs not being emitted in release builds.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.40.1 released! 2023-04-20T00:00:00+00:00 This is the first bug fix release in the stable 2.40 series. What's new in the WebKitGTK 2.40.1 release?</h3> The Bubblewrap sandbox no longer requires setting an application identifier via GApplication to operate correctly. Using GApplication is still recommended, but optional.</li> Adjust the scrolling speed for mouse wheels to make it feel more natural.</li> Allow pasting content using the Asynchronous Clipboard API when the origin is the same as the clipboard contents.</li> Improvements to the GStreamer multimedia playback, in particular around MSE, WebRTC, and seeking.</li> Make all supported image types appear in the Accept HTTP header.</li> Fix text caret blinking when blinking is disabled in the GTK settings.</li> Fix default database quota size definition.</li> Fix application of all caps tags listed in the font-feature-settings CSS property.</li> Fix the build with journald support enabled when using elogind instead of the systemd libraries.</li> Fix the build when libgcrypt provides a libgcrypt-config script instead of a pkg-config module file.</li> Fix font height calculations for the font-size-adjust CSS property.</li> Fix the build when ccache is used in certain setups.</li> Fix the build for RISC-V 64-bit targets.</li> Fix the build with GCC 13.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.41.2 released! 2023-04-14T00:00:00+00:00 This is a development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.2 release?</h3> Properly handle the modifier value when exporting/importing DMA-BUF buffers.</li> Don't require GApplication for bubblewrap sandbox.</li> Fix cap height calculation in font metrics.</li> Fix the build on i386.</li> Fix the build with libgbm disabled.</li> Fix several crashes and rendering issues.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.41.1 released! 2023-03-30T00:00:00+00:00 This is the first development release leading toward 2.42 series. What's new in the WebKitGTK 2.41.1 release?</h3> Use DMABuf and WebKit IPC for rendering instead of wpe/x11.</li> Calculate scroll step depending on scrollable area size when scrolling with the mouse wheel or arrow keys.</li> Add WebKitClipboardPermissionRequest to handle DOM paste access requests.</li> Remove support for rendering with GLX in the web process.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.40.0 released! 2023-03-17T00:00:00+00:00 This is the first stable release in the 2.40 series. Highlights of the WebKitGTK 2.40.0 release</h3> New GTK4 API is now stable.</li> Use ANGLE for WebGL implementation and enable WebGL2.</li> Prefer EGL over X11, intead of GLX, where available.</li> Add support for speech synthesis using Flite.</li> Enable the async clipboard API.</li> Add API to query the permission state of web features.</li> Add API to support asynchronously returning values from user script messages.</li> Make it possible to handle WebKitDownload::decide-destination signal asynchronously.</li> Add new JavaScript execution APIs.</li> Make webkit://gpu output exportable as JSON.</li> Fix large memory allocation when uploading content.</li> </ul> For more details about all the changes included in WebKitGTK 2.40 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.39.91 released! 2023-03-08T00:00:00+00:00 This is a development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.91 release?</h3> Rename WebKitWebExtension to WebKitWebProcessExtension in GTK4 API.</li> Remove WebKitJavascriptResult in favor of using JSCValue directly in GTK4 API.</li> Add new API to get the request body of WebKitURISchemeRequest.</li> Make it possible to handle WebKitDownload::decide-destination signal asynchronously.</li> Allow WebKitDownload destination to be a path instead of a URI.</li> Make webkit://gpu output exportable as JSON.</li> Improve scrolling performance in accelerated compositing mode.</li> Implement KeyboardEvent.repeat.</li> Fix a crash in MiniBrowser when the favicon is updated.</li> Fix the build in Ubuntu 20.04 and Debian Stable.</li> Fix several crashes and rendering issues.</li> Translation updates: Korean, Polish, Swedish, Korean.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.39.90 released! 2023-02-20T00:00:00+00:00 This is a development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.90 release?</h3> Add new JavaScript execution APIs.</li> Merge functions of registering and unregistering script message handler in GTK4 API.</li> Mark non-derivable types as final and make instance and class struct declarations private in GTK4 API.</li> Make favicon and snapshot API use GdkTexture instead of cairo surfaces in GTK4 API.</li> Fix scrolling after a history navigation with PSON enabled.</li> Fix criticals from webkitOptionMenuSetEvent when opening any combo box.</li> Fix large memory allocation when uploading content.</li> Always update the active uri of WebKitFrame.</li> Fix several crashes and rendering issues.</li> Translation updates: Ukrainian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.38.5 released! 2023-02-15T00:00:00+00:00 This is a bug fix release in the stable 2.38 series. What's new in the WebKitGTK 2.38.5 release?</h3> Fix large memory allocation when uploading content.</li> Fix scrolling after a history navigation with PSON enabled.</li> Always update the active uri of WebKitFrame.</li> Fix the build on Ubuntu 20.04.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0002 2023-02-15T00:00:00+00:00 Date Reported: February 15, 2023 </li> Advisory ID: WSA-2023-0002 </li> CVE identifiers: CVE-2023-23529</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-23529</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.5.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A type confusion issue was addressed with improved checks.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.38.4 released! 2023-02-02T00:00:00+00:00 This is a bug fix release in the stable 2.38 series. What's new in the WebKitGTK 2.38.4 release?</h3> Improve GStreamer multimedia playback across the board with improved codec selection logic, better handling of latency, and improving frame discard to avoid audio/video desynchronization, among other fixes.</li> Disable HLS media playback by default, which makes web sites use MSE instead. If needed WEBKIT_GST_ENABLE_HLS_SUPPORT=1</code> can be set in the environment to enable it back.</li> Disable threaded rendering in GTK4 builds by default, as it was causing crashes.</li> Fix MediaSession API not showing artwork images.</li> Fix MediaSession MPRIS usage when running inside a Flatpak sandbox.</li> Fix input element controls to correctly scale when applying a zoom factor different than the default.</li> Fix leakage of Web processes in certain situations.</li> Fix the injected bundle not being found when running inside a sandbox.</li> Fix the build with ENABLE_INTROSPECTION</code> when cross-compiling.</li> FIx the build with ENABLE_WEBGL</code> disabled.</li> Fix the build with GStreamer-based WebRTC enabled.</li> Fix the build with USE_GTK4</code> enabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2023-0001 2023-02-02T00:00:00+00:00 Date Reported: February 02, 2023 </li> Advisory ID: WSA-2023-0001 </li> CVE identifiers: CVE-2023-23517</a>, CVE-2023-23518</a>, CVE-2022-42826</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2023-23517</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.4.</li> Credit to YeongHyeon Choi (@hyeon101010), Hyeon Park (@tree_segment), SeOk JEON (@_seokjeon), YoungSung Ahn (@_ZeroSung), JunSeo Bae (@snakebjs0107), Dohyun Lee (@l33d0hyun) of Team ApplePIE.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> </ul> </li> CVE-2023-23518</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.4.</li> Credit to YeongHyeon Choi (@hyeon101010), Hyeon Park (@tree_segment), SeOk JEON (@_seokjeon), YoungSung Ahn (@_ZeroSung), JunSeo Bae (@snakebjs0107), Dohyun Lee (@l33d0hyun) of Team ApplePIE.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.</li> </ul> </li> CVE-2022-42826</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.4.</li> Credit to Francisco Alonso (@revskills).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.39.7 released! 2023-01-31T00:00:00+00:00 This is a development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.7 release?</h3> Fix the webkit.h public header causing applications to fail to build.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.39.6 released! 2023-01-30T00:00:00+00:00 This is a development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.6 release?</h3> Add support for speech synthesis using Flite.</li> Bring back WebKitConsoleMessage API implementation.</li> Fix async scroll event propagation for GTK4.</li> Add network session API when building with GTK4.</li> Make most public types final when building with GTK4.</li> Remove WebKitPrintCustomWidget when building with GTK4.</li> Remove most of the webkit_web_view_new_with_*() constructors when building with GTK4.</li> Remove webkit_web_context_get/set_process_model when building with GTK4.</li> Do not allow the sandbox to mount the entire home directory.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.39.5 released! 2023-01-19T00:00:00+00:00 This is a development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.5 release?</h3> Enable WebGL2 by default again that was disabled by mistake.</li> Fix the build with WebGL disabled.</li> Fix the webkit.h public header causing applications to fail to build.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.39.4 released! 2023-01-16T00:00:00+00:00 This is a development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.4 release?</h3> Fix WebGL when sandbox is enabled.</li> Fix loading of media documents.</li> Add new API disable web security.</li> Disable support for HLS in media backend by default.</li> Fix several crashes and rendering issues.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0011 2022-12-26T00:00:00+00:00 Date Reported: December 26, 2022 </li> Advisory ID: WSA-2022-0011 </li> CVE identifiers: CVE-2022-42852</a>, CVE-2022-42856</a>, CVE-2022-42863</a>, CVE-2022-42867</a>, CVE-2022-46691</a>, CVE-2022-46692</a>, CVE-2022-46698</a>, CVE-2022-46699</a>, CVE-2022-46700</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-42852</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.3.</li> Credit to hazbinhotel working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may result in the disclosure of process memory. Description: The issue was addressed with improved memory handling.</li> </ul> </li> CVE-2022-42856</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.3.</li> Credit to Clément Lecigne of Google's Threat Analysis Group.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved state handling.</li> </ul> </li> CVE-2022-42863</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.0.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2022-42867</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.3.</li> Credit to Maddie Stone of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2022-46691</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.1.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory consumption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2022-46692</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.3.</li> Credit to KirtiKumar Anandrao Ramchandani.</li> Impact: Processing maliciously crafted web content may bypass Same Origin Policy. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2022-46698</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.3.</li> Credit to Dohyun Lee (@l33d0hyun) of DNSLab at Korea University, Ryan Shin of IAAI SecLab at Korea University.</li> Impact: Processing maliciously crafted web content may disclose sensitive user information. Description: A logic issue was addressed with improved checks.</li> </ul> </li> CVE-2022-46699</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.3.</li> Credit to Samuel Groß of Google V8 Security.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2022-46700</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.3.</li> Credit to Samuel Groß of Google V8 Security.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved input validation.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.38.3 released! 2022-12-22T00:00:00+00:00 This is a bug fix release in the stable 2.38 series. What's new in the WebKitGTK 2.38.3 release?</h3> Fix runtime critical warnings from media player.</li> Fix network process crash when fetching website data on ephemeral session.</li> Fix the build with Ruby 3.2.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.39.3 released! 2022-12-14T00:00:00+00:00 This is a development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.3 release?</h3> Add new API to query the permission state of web features.</li> Deprecate all web extension DOM APIs (WebKitDOMDocument, WebKitDOMElement, WebKitDOMNode).</li> Add webkit_web_hit_test_result_get_js_node() to get the JSCValue for the node.</li> Add WebKitWebFormManager and deprecate WebKitWebPage form related signals.</li> Don't perform position queries on video sink when the player is for audio only.</li> Fix gibberish text when loading alternate data.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.39.2 released! 2022-11-28T00:00:00+00:00 This is a development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.2 release?</h3> Add API to support asynchronously returning values from user script messages.</li> Deprecate WebKitConsoleMessage API.</li> Deprecate event parameter of WebKitWebView::context-menu and WebKitWebView::show-option-menu signals in favor of a getter in WebKitConextMenu and WebKitOptionMenu.</li> Do not emit context-menu signals for media settings popup menu.</li> Use async scrolling also for keyboard scrolling.</li> Add support for client side certificates on WebSocket connections.</li> Fix first party for cookies set on every media request.</li> Fix a crash on authentication dialog with GTK4.</li> Fix web process leak when webkit_download_set_destination is called with empty destination.</li> Fix several warnings when building for ARMv7 (32-bits).</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.39.1 released! 2022-11-11T00:00:00+00:00 This is the first development release leading toward 2.40 series. What's new in the WebKitGTK 2.39.1 release?</h3> Use ANGLE for WebGL implementation and enable WebGL2.</li> Remove internal nested wayland compositor making libwpe mandatory when building with wayland enabled.</li> Prefer EGL over X11, intead of GLX, where available.</li> Add support for background-repeat: space.</li> Add API to check if a response policy decision is for the main resource.</li> Fix rendering of checkbox and radio buttons in black backgrounds.</li> Make checkbox, radio and inner spin button scale along by page zoom.</li> Add support for get computed label and get computed role WebDriver commands.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.38.2 released! 2022-11-04T00:00:00+00:00 This is a bug fix release in the stable 2.38 series. What's new in the WebKitGTK 2.38.2 release?</h3> Fix scrolling issues in some sites having fixed background.</li> Fix prolonged buffering during progressive live playback.</li> Fix the build with accessibility disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0010 2022-11-04T00:00:00+00:00 Date Reported: November 04, 2022 </li> Advisory ID: WSA-2022-0010 </li> CVE identifiers: CVE-2022-32888</a>, CVE-2022-32923</a>, CVE-2022-42799</a>, CVE-2022-42823</a>, CVE-2022-42824</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-32888</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.0.</li> Credit to P1umer (@p1umer).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An out-of-bounds write issue was addressed with improved bounds checking.</li> </ul> </li> CVE-2022-32923</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.0.</li> Credit to Wonyoung Jung (@nonetype_pwn) of KAIST Hacking Lab.</li> Impact: Processing maliciously crafted web content may disclose internal states of the app. Description: A correctness issue in the JIT was addressed with improved checks.</li> </ul> </li> CVE-2022-42799</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.2.</li> Credit to Jihwan Kim (@gPayl0ad), Dohyun Lee. (@l33d0hyun).</li> Impact: Visiting a malicious website may lead to user interface spoofing. Description: The issue was addressed with improved UI handling.</li> </ul> </li> CVE-2022-42823</a> Versions affected: WebKitGTK and WPE WebKit before 2.38.2.</li> Credit to Dohyun Lee (@l33d0hyun) of SSD Labs.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2022-42824</a> Versions affected: WebKitGTK before 2.38.2.</li> Credit to Abdulrahman Alqabandi of Microsoft Browser Vulnerability Research, Ryan Shin of IAAI SecLab at Korea University, Dohyun Lee (@l33d0hyun) of DNSLab at Korea University.</li> Impact: Processing maliciously crafted web content may disclose sensitive user information. Description: A logic issue was addressed with improved state management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.38.1 released! 2022-10-20T00:00:00+00:00 This is the first bug fix release in the stable 2.38 series. What's new in the WebKitGTK 2.38.1 release?</h3> Make xdg-dbus-proxy work if host session bus address is an abstract socket.</li> Use a single xdg-dbus-proxy process when sandbox is enabled.</li> Fix high resolution video playback due to unimplemented changeType operation.</li> Ensure GSubprocess uses posix_spawn() again and inherit file descriptors.</li> Fix player stucking in buffering (paused) state for progressive streaming.</li> Do not try to preconnect on link click when link preconnect setting is disabled.</li> Fix close status code returned when the client closes a WebSocket in some cases.</li> Fix media player duration calculation.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0009 2022-09-19T00:00:00+00:00 Date Reported: September 19, 2022 </li> Advisory ID: WSA-2022-0009 </li> CVE identifiers: CVE-2022-32886</a>, CVE-2022-32891</a>, CVE-2022-32912</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-32886</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.8.</li> Credit to P1umer, afang5472, xmzyshypnc.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A buffer overflow issue was addressed with improved memory handling.</li> </ul> </li> CVE-2022-32891</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.5.</li> Credit to @real_as3617, an anonymous researcher.</li> Impact: Visiting a website that frames malicious content may lead to UI spoofing. Description: The issue was addressed with improved UI handling.</li> </ul> </li> CVE-2022-32912</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.8.</li> Credit to Jeonghoon Shin (@singi21a) at Theori working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An out-of-bounds read was addressed with improved bounds checking. This issue only affects MacOS builds (Linux builds are not affected).</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.36.8 released! 2022-09-16T00:00:00+00:00 This is a bug fix release in the stable 2.36 series. What's new in the WebKitGTK 2.36.8 release?</h3> Fix jumpy elements when scrolling GitLab and other web sites.</li> Fix WebKitWebView:web-process-terminated</code> signal not being emitted for the first web view when sandboxing is enabled.</li> Fix hang when opening HTML <select></code> elements in GTK4 builds.</li> Fix kinetic scrolling with elements that use overflow scrolling.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.38.0 released! 2022-09-16T00:00:00+00:00 This is the first stable release in the 2.38 series. Highlights of the WebKitGTK 2.38.0 release</h3> New media controls UI style.</li> Add new API to set WebView's Content-Security-Policy for web extensions support.</li> Make it possible to use the remote inspector from other browsers using WEBKIT_INSPECTOR_HTTP_SERVER env var.</li> MediaSession is enabled by default, allowing remote media control using MPRIS.</li> Add support for PDF documents using PDF.js.</li> </ul> For more details about all the changes included in WebKitGTK 2.38 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.37.91 released! 2022-09-02T00:00:00+00:00 This is a development release leading toward 2.38 series. What's new in the WebKitGTK 2.37.91 release?</h3> Cache and reuse image-based backing stores to improve memory consumption.</li> Fix printing with bubblewrap sandbox enabled</li> Deprecate enable-frame-flattening setting because the functionality will be removed for 2.40.</li> Fix deadlock when disposing player while handling rotation tag.</li> Fix several crashes and rendering issues.</li> Translation updates: Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 2022-08-25T00:00:00+00:00 Date Reported: August 25, 2022 </li> Advisory ID: WSA-2022-0008 </li> CVE identifiers: CVE-2022-32893</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-32893</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.7.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.36.7 released! 2022-08-24T00:00:00+00:00 This is a bug fix release in the stable 2.36 series. What's new in the WebKitGTK 2.36.7 release?</h3> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.37.90 released! 2022-08-19T00:00:00+00:00 This is a development release leading toward 2.38 series. What's new in the WebKitGTK 2.37.90 release?</h3> Remove libnotify dependency.</li> Add support for service worker notifications.</li> Add support for loading the notification icon.</li> Add support for pac proxy type in WebDriver.</li> Fix several crashes and rendering issues.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.36.6 released! 2022-08-07T00:00:00+00:00 This is a bug fix release in the stable 2.36 series. What's new in the WebKitGTK 2.36.6 release?</h3> Fix handling of touchpad scrolling on GTK4 builds.</li> Fix WebKitGTK not allowing to be used from non-main threads.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.36.5 released! 2022-07-28T00:00:00+00:00 This is a bug fix release in the stable 2.36 series. What's new in the WebKitGTK 2.36.5 release?</h3> Add support for PAC proxy in the WebDriver implementation.</li> Fix video playback when loaded through custom URIs, this fixes video playback in the Yelp documentation browser.</li> Fix WebKitWebView::context-menu when using GTK4.</li> Fix LTO builds with GCC.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0007 2022-07-28T00:00:00+00:00 Date Reported: July 28, 2022 </li> Advisory ID: WSA-2022-0007 </li> CVE identifiers: CVE-2022-32792</a>, CVE-2022-32816</a>, CVE-2022-2294</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-32792</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.5.</li> Credit to Manfred Paul (@_manfp) working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An out-of-bounds write issue was addressed with improved input validation.</li> </ul> </li> CVE-2022-32816</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.5.</li> Credit to Dohyun Lee (@l33d0hyun) of SSD Secure Disclosure Labs & DNSLab, Korea Univ.</li> Impact: Visiting a website that frames malicious content may lead to UI spoofing. Description: The issue was addressed with improved UI handling.</li> </ul> </li> CVE-2022-2294</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.5 if USE_LIBWEBRTC is enabled.</li> Credit to Jan Vojtesek of Avast Threat Intelligence team.</li> Heap buffer overflow in LibWebRTC allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. NOTE: The tarballs of WebKitGTK or WPE WebKit don't ship LibWebRTC. Also the LibWebRTC support is disabled by default. You only are affected by this vulnerability if your build enabled the USE_LIBWEBRTC CMake option and used the repository as source instead of the tarballs.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.37.1 released! 2022-07-12T00:00:00+00:00 This is the first development release leading toward 2.38 series. What's new in the WebKitGTK 2.37.1 release?</h3> Add initial implementation of WebRTC using GstWebRTC if GStreamer 1.20 is available, disabled by default via web view settings.</li> Add new API to set WebView's Content-Security-Policy for web extensions support.</li> Add new API to run async JavaScript functions.</li> Expose typed arrays in JavaScriptCore GLib API.</li> Add support for PDF documents using PDF.js.</li> Show font name and font variant settings in the inspector.</li> MediaSession is enabled by default, allowing remote media control using MPRIS.</li> Modernized media controls UI.</li> Add Support Google Dynamic Ad Insertion (DAI).</li> Add support for capturing encoded video streams from a webcam.</li> Make it possible to use the remote inspector from other browsers using WEBKIT_INSPECTOR_HTTP_SERVER env var.</li> Add support for IPv6 in the remote inspector.</li> Update form elements style to match libadwaita.</li> Fix canvas animations and images with threaded rendering enabled.</li> Switch to use gi-docgen for API documentation instead of gtk-doc.</li> Remove the ATK a11y implementation that has been replaced by AT-SPI DBus interfaces.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.36.4 released! 2022-07-05T00:00:00+00:00 This is a bug fix release in the stable 2.36 series. What's new in the WebKitGTK 2.36.4 release?</h3> Fix the new ATSPI accessibility implementation to add the missing Collection interface for the loaded document.</li> Fix the MediaSession implementation to make the MPRIS object names more sandbox friendly, which plays better with Flatpak and WebKit's own Bubblwrap-based sandboxing.</li> Fix leaked Web Processes in some particular situations.</li> Fix the build with media capture support enabled.</li> Fix cross-compilation when targeting 64-bit ARM.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0006 2022-07-05T00:00:00+00:00 Date Reported: July 05, 2022 </li> Advisory ID: WSA-2022-0006 </li> CVE identifiers: CVE-2022-22662</a>, CVE-2022-22677</a>, CVE-2022-26710</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-22662</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.0.</li> Credit to Prakash (@1lastBr3ath) of Threat Nix.</li> Impact: Processing maliciously crafted web content may disclose sensitive user information. Description: A cookie management issue was addressed with improved state management.</li> </ul> </li> CVE-2022-22677</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.4.</li> Credit to an anonymous researcher.</li> Impact: The video in a webRTC call may be interrupted if the audio capture gets interrupted. Description: A logic issue in the handling of concurrent media was addressed with improved state handling. NOTE: The tarballs of WebKitGTK or WPE WebKit don't ship LibWebRTC. Also the LibWebRTC support is disabled by default. You only are affected by this vulnerability if your build enabled the USE_LIBWEBRTC CMake option and used the repository as source instead of the tarballs.</li> </ul> </li> CVE-2022-26710</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.4.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0005 2022-05-30T00:00:00+00:00 Date Reported: May 30, 2022 </li> Advisory ID: WSA-2022-0005 </li> CVE identifiers: CVE-2022-26700</a>, CVE-2022-26709</a>, CVE-2022-26717</a>, CVE-2022-26716</a>, CVE-2022-26719</a>, CVE-2022-30293</a>, CVE-2022-30294</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-26700</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.3.</li> Credit to ryuzaki.</li> Impact: Processing maliciously crafted web content may lead to code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2022-26709</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.3.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2022-26717</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.3.</li> Credit to Jeonghoon Shin of Theori.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2022-26716</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.3.</li> Credit to SorryMybad (@S0rryMybad) of Kunlun Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2022-26719</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.3.</li> Credit to Dongzhuo Zhao working with ADLab of Venustech.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2022-30293</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.1.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or to a denial of service (application crash). Description: A memory corruption issue that could cause a heap use after free or a heap buffer overflow in WebCore::TextureMapperLayer::setContentsLayer was addressed with improved state management.</li> </ul> </li> CVE-2022-30294</a> Versions affected: WebKitGTK and WPE WebKit before 2.36.1.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or to a denial of service (application crash). Description: A memory corruption issue that could cause a heap use after free or a heap buffer overflow in WebCore::TextureMapperLayer::setContentsLayer was addressed with improved state management. This is the same issue than CVE-2022-30293.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.36.3 released! 2022-05-28T00:00:00+00:00 This is a bug fix release in the stable 2.36 series. What's new in the WebKitGTK 2.36.3 release?</h3> Support capturing already encoded video streams, which takes advantage of encoding done in hardware by devices which support this feature.</li> Avoid using experimental GStreamer elements for video demuxing.</li> Avoid using the legacy GStreamer VA-API decoding plug-ins, which often cause rendering issues and are not much maintained. Their usage can be re-enabled setting WEBKIT_GST_ENABLE_LEGACY_VAAPI=1</code> in the environment.</li> Fix playback of YouTube streams which use dynamic ad insertion.</li> Fix display capture with Pipewire.</li> Fix the build without the X11 target when X11 headers are not present.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.36.2 released! 2022-05-18T00:00:00+00:00 This is a bug fix release in the stable 2.36 series. What's new in the WebKitGTK 2.36.2 release?</h3> Fix some pages showing empty content boxes when using GTK4.</li> Fix the build with accessibility disabled.</li> Fix the build with newer Ruby versions.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.36.1 released! 2022-04-21T00:00:00+00:00 This is the first bug fix release in the stable 2.36 series. What's new in the WebKitGTK 2.36.1 release?</h3> Fix the build with accessibility disabled.</li> Fix several crashes and rendering issues.</li> Translation updates: Croatian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004 2022-04-08T00:00:00+00:00 Date Reported: April 08, 2022 </li> Advisory ID: WSA-2022-0004 </li> CVE identifiers: CVE-2022-22624</a>, CVE-2022-22628</a>, CVE-2022-22629</a>, CVE-2022-22637</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-22624</a> Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7.</li> Credit to Kirin (@Pwnrin) of Tencent Security Xuanwu Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2022-22628</a> Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7.</li> Credit to Kirin (@Pwnrin) of Tencent Security Xuanwu Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2022-22629</a> Versions affected: WebKitGTK before 2.36.0 and WPE WebKit before 2.34.7.</li> Credit to Jeonghoon Shin at Theori working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A buffer overflow issue was addressed with improved memory handling.</li> </ul> </li> CVE-2022-22637</a> Versions affected: WebKitGTK before 2.34.4 and WPE WebKit before 2.34.4.</li> Credit to Tom McKee of Google.</li> Impact: A malicious website may cause unexpected cross-origin behavior. Description: A logic issue was addressed with improved state management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.36.0 released! 2022-03-21T00:00:00+00:00 This is the first stable release in the 2.36 series. Highlights of the WebKitGTK 2.36.0 release</h3> Add new accessibility implementation using ATSPI DBus interfaces instead of ATK.</li> Add support for requestVideoFrameCallback.</li> Change hardware-acceleration-policy setting default value to always.</li> Add support for media session.</li> Add new API to set HTTP response information to custom uri schemes.</li> Make user interactive threads (event handler, scrolling, ...) real time in linux.</li> </ul> For more details about all the changes included in WebKitGTK 2.36 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.35.90 released! 2022-02-25T00:00:00+00:00 This is a development release leading toward 2.36 series. What's new in the WebKitGTK 2.35.90 release?</h3> Fix scrolling with the mouse wheel on sites using overscroll-behavior.</li> Suspend web processes after some time in the process cache.</li> Fix renderning of horizontal scrollbars with themes enabling steppers.</li> Ensure EGL displays are terminated before web process exits.</li> Deinitialize gstreamer before web process exits.</li> Make fonts under XDG_DATA_DIRS available in web process sanbox.</li> Canonicalize paths passed to bubblewrap launcher.</li> Fix several crashes and rendering issues.</li> Translation updates: Hebrew.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.34.6 released! 2022-02-17T00:00:00+00:00 This is a bug fix release in the stable 2.34 series. What's new in the WebKitGTK 2.34.6 release?</h3> Fix accessibility not working when the Bubblewrap sandbox is enabled.</li> Fix rendering of scrollbars when overlay scrollbars are disabled.</li> Fix the build when the X11 support is disabled.</li> Fix the build in a number of situations where the main OpenGL library is not called libGL or libgl, as is the case on systems that use libglvnd.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0003 2022-02-17T00:00:00+00:00 Date Reported: February 17, 2022 </li> Advisory ID: WSA-2022-0003 </li> CVE identifiers: CVE-2022-22620</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-22620</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.6.</li> Credit to an anonymous researcher.</li> Impact: processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.34.5 released! 2022-02-09T00:00:00+00:00 This is a bug fix release in the stable 2.34 series. What's new in the WebKitGTK 2.34.5 release?</h3> Improve VP8 codec selection when using GStreamer 1.20.</li> Fix connecting to the accessiblity bus when using the Bubblewrap sandbox.</li> Fix links being incorrectly activated when starting a pinch zoom gesture.</li> Fix touch-based scrolling.</li> Fix the build with recent toolchains based on GCC 12 and on older ones as included e.g. in Ubuntu 18.04.</li> Fix the build with ICU 60, version 61 is no longer required.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.35.3 released! 2022-02-09T00:00:00+00:00 This is a development release leading toward 2.36 series. What's new in the WebKitGTK 2.35.3 release?</h3> Fix a crash at startup when bubblewrap sandbox is enabled.</li> Fix a crash when starting a drag an drop on touchscreen.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0002 2022-02-09T00:00:00+00:00 Date Reported: February 09, 2022 </li> Advisory ID: WSA-2022-0002 </li> CVE identifiers: CVE-2022-22589</a>, CVE-2022-22590</a>, CVE-2022-22592</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-22589</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.5.</li> Credit to Heige of KnownSec 404 Team (knownsec.com) and Bo Qu of Palo Alto Networks (paloaltonetworks.com).</li> Impact: Processing a maliciously crafted mail message may lead to running arbitrary javascript. Description: A validation issue was addressed with improved input sanitization.</li> </ul> </li> CVE-2022-22590</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.5.</li> Credit to Toan Pham from Team Orca of Sea Security (security.sea.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2022-22592</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.5.</li> Credit to Prakash (@1lastBr3ath).</li> Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved state management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.35.2 released! 2022-02-03T00:00:00+00:00 This is a development release leading toward 2.36 series. What's new in the WebKitGTK 2.35.2 release?</h3> Add new accessibility implementation using ATSPI DBus interfaces instead of ATK.</li> Use native GtkWidgets for form validation popups.</li> Add support for requestVideoFrameCallback.</li> Add support for accent colors.</li> Fix pinch zooming from a link to not activate the link.</li> Fix kinetic scrolling via touch screen.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.34.4 released! 2022-01-21T00:00:00+00:00 This is a bug fix release in the stable 2.34 series. What's new in the WebKitGTK 2.34.4 release?</h3> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001 2022-01-21T00:00:00+00:00 Date Reported: January 21, 2022 </li> Advisory ID: WSA-2022-0001 </li> CVE identifiers: CVE-2021-30934</a>, CVE-2021-30936</a>, CVE-2021-30951</a>, CVE-2021-30952</a>, CVE-2021-30953</a>, CVE-2021-30954</a>, CVE-2021-30984</a>, CVE-2022-22594</a>, CVE-2021-45481</a>, CVE-2021-45482</a>, CVE-2021-45483</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2021-30934</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.</li> Credit to Dani Biro.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A buffer overflow issue was addressed with improved memory handling.</li> </ul> </li> CVE-2021-30936</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-30951</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.</li> Credit to Pangu.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-30952</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.</li> Credit to WeBin.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An integer overflow was addressed with improved input validation.</li> </ul> </li> CVE-2021-30953</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.</li> Credit to VRIJ.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An out-of-bounds read was addressed with improved bounds checking.</li> </ul> </li> CVE-2021-30954</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.</li> Credit to Kunlun Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2021-30984</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.</li> Credit to Kunlun Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A race condition was addressed with improved state handling.</li> </ul> </li> CVE-2022-22594</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.</li> Credit to Martin Bajanik of fingerprintjs.com.</li> Impact: A website may be able to track sensitive user information. Description: A cross-origin issue in the IndexDB API was addressed with improved input validation. Notes: There is a public PoC demonstrating this issue at safarileaks.com so it may have been actively exploited.</li> </ul> </li> CVE-2021-45481</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Processing maliciously crafted web content may cause an application crash due to an incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create.</li> </ul> </li> CVE-2021-45482</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.4.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Processing maliciously crafted web content may cause a memory corruption issue (use-after-free) in WebCore::ContainerNode::firstChild.</li> </ul> </li> CVE-2021-45483</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Processing maliciously crafted web content may cause a memory corruption issue (heap-use-after-free) in WebCore::Frame::page.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.34.3 released! 2021-12-20T00:00:00+00:00 This is a bug fix release in the stable 2.34 series. What's new in the WebKitGTK 2.34.3 release?</h3> Make audio tools (like mixers) display the actual name of the application producing sound, instead of a generic one.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007 2021-12-20T00:00:00+00:00 Date Reported: December 20, 2021 </li> Advisory ID: WSA-2021-0007 </li> CVE identifiers: CVE-2021-30809</a>, CVE-2021-30818</a>, CVE-2021-30823</a>, CVE-2021-30836</a>, CVE-2021-30884</a>, CVE-2021-30887</a>, CVE-2021-30888</a>, CVE-2021-30889</a>, CVE-2021-30890</a>, CVE-2021-30897</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2021-30809</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.4.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-30818</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to Amar Menezes (@amarekano) of Zon8Research.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved state handling.</li> </ul> </li> CVE-2021-30823</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to David Gullasch of Recurity Labs.</li> Impact: An attacker in a privileged network position may be able to bypass HSTS. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2021-30836</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.4.</li> Credit to Peter Nguyen Vu Hoang of STAR Labs.</li> Impact: Processing a maliciously crafted audio file may disclose restricted memory. Description: An out-of-bounds read was addressed with improved input validation.</li> </ul> </li> CVE-2021-30884</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to an anonymous researcher.</li> Impact: Visiting a maliciously crafted website may reveal a user's browsing history. Description: The issue was resolved with additional restrictions on CSS compositing.</li> </ul> </li> CVE-2021-30887</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.3.</li> Credit to Narendra Bhati (@imnarendrabhati) of Suma Soft Pvt. Ltd.</li> Impact: Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2021-30888</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to Prakash (@1lastBr3ath).</li> Impact: A malicious website using Content Security Policy reports may be able to leak information via redirect behavior. Description: An information leakage issue was addressed.</li> </ul> </li> CVE-2021-30889</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution, Description: A buffer overflow issue was addressed with improved memory handling.</li> </ul> </li> CVE-2021-30890</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.3.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2021-30897</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to an anonymous researcher.</li> Impact: A malicious website may exfiltrate data cross-origin. Description: An issue existed in the specification for the resource timing API. The specification was updated and the updated specification was implemented.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.35.1 released! 2021-11-25T00:00:00+00:00 This is the first development release leading toward 2.36 series. What's new in the WebKitGTK 2.35.1 release?</h3> Make user interactive threads (event handler, scrolling, ...) real time in linux.</li> Add new API to set HTTP response information to custom uri schemes.</li> Add support for media session.</li> Change hardware-acceleration-policy setting default value to always.</li> Fix jsc_value_object_define_property_accessor() to work with objects not having a wrapped instance.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.34.2 released! 2021-11-24T00:00:00+00:00 This is a bug fix release in the stable 2.34 series. What's new in the WebKitGTK 2.34.2 release?</h3> Fix scrolling issues when pressing Home and PgDown keys.</li> Update effective appearance after web process switch on navigation.</li> Fix the build with video disabled.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 2021-10-26T00:00:00+00:00 Date Reported: October 26, 2021 </li> Advisory ID: WSA-2021-0006 </li> CVE identifiers: CVE-2021-30846</a>, CVE-2021-30848</a>, CVE-2021-30849</a>, CVE-2021-30851</a>, CVE-2021-30858</a>, CVE-2021-42762</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2021-30846</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2021-30848</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.4.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to code execution. Description: A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2021-30849</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.4.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2021-30851</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.0.</li> Credit to Samuel Groß of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to code execution. Description: A memory corruption vulnerability was addressed with improved locking.</li> </ul> </li> CVE-2021-30858</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.4.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-42762</a> Versions affected: WebKitGTK and WPE WebKit before 2.34.1.</li> Credit to an anonymous reporter.</li> BubblewrapLauncher.cpp allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.34.1 released! 2021-10-21T00:00:00+00:00 This is the first bug fix release in the stable 2.34 series. What's new in the WebKitGTK 2.34.1 release?</h3> Update user agent browser versions.</li> Fix a crash with GTK >= 3.24.30.</li> Fix a crash when loading videos on reddit.</li> Fix file type detection when application calls g_desktop_app_info_set_as_default_for_extension() passing html.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.34.0 released! 2021-09-22T00:00:00+00:00 This is the first stable release in the 2.34 series. Highlights of the WebKitGTK 2.34.0 release</h3> Add support for HTTP/2 when building with libsoup3.</li> Add support for CSS Scroll Snap.</li> Add support for date and datetime-local input elements.</li> Add support for display capture.</li> Add support for ICC color management.</li> Add support color-schemes CSS property.</li> Add support for link preconnect when building with libsoup3.</li> Add support for client side certificates when building with libsoup3.</li> Add multi-track support to MSE media backend.</li> Add new API to handle web process unresponsiveness.</li> Add API to disable CORS on a web view for particular domains.</li> Add new API to access/modify capture devices states.</li> Add new API to configure the memory pressure handler.</li> </ul> For more details about all the changes included in WebKitGTK 2.34 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2021-0005 2021-09-20T00:00:00+00:00 Date Reported: September 20, 2021 </li> Advisory ID: WSA-2021-0005 </li> CVE identifiers: CVE-2021-30858</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2021-30858</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.4.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.32.4 released! 2021-09-17T00:00:00+00:00 This is a bug fix release in the stable 2.32 series. What's new in the WebKitGTK 2.32.4 release?</h3> Do not append .asc extension to downloaded text/plain files.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.33.91 released! 2021-09-17T00:00:00+00:00 This is a development release leading toward 2.34 series. What's new in the WebKitGTK 2.33.91 release?</h3> Use the right display refresh monitor for animations in accelerated compositng mode.</li> Fix several issues in JavaScriptCore on 32bit systems.</li> Prefer python3 over python2 in CMake.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.33.90 released! 2021-09-02T00:00:00+00:00 This is a development release leading toward 2.34 series. What's new in the WebKitGTK 2.33.90 release?</h3> Show TLS protocol version and ciphersuite name in the inspector when building with libsoup3.</li> Add multi-track support to media backend.</li> Avoid strong alias computations in font fallback code.</li> Fix deadlock tearing down pipeline when using fallback sink.</li> Fix the build with gtk-doc enabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.33.3 released! 2021-08-16T00:00:00+00:00 This is a development release leading toward 2.34 series. What's new in the WebKitGTK 2.33.3 release?</h3> Add support for display capture.</li> Add new API to access/modify capture devices states.</li> Add new API to configure the memory pressure handler.</li> Add support for client side certifiates authentication.</li> Add support color-schemes CSS property.</li> Add support for dark scrollbars.</li> Keep GtkSettings used by web processes in sync with the settings set in the UI process.</li> Add support for drawing the scrollbars corner.</li> Allow to opt-out of GL rendering at runtime for media player.</li> Add support for A420 compositing in media player.</li> Improve pinch to zoom gesture in accerlerated compositing mode.</li> Fix cookies configuration after a network process crash.</li> Fix touchscreen navigation swipe when the page scrolls horizontally.</li> Fix rendering of elliptic radial gradients.</li> Fix several crashes and rendering issues.</li> Translation updates: Brazilian Portuguese, French, Swedish, Ukrainian</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.32.3 released! 2021-07-23T00:00:00+00:00 This is a bug fix release in the stable 2.32 series. What's new in the WebKitGTK 2.32.3 release?</h3> Properly set the cookies settings after a network process crash.</li> Fix accessibility tree after a cross site navigation with PSON enabled.</li> Ensure WebKitScriptWorld::window-object-cleared signal is always emitted.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2021-0004 2021-07-23T00:00:00+00:00 Date Reported: July 23, 2021 </li> Advisory ID: WSA-2021-0004 </li> CVE identifiers: CVE-2021-1817</a>, CVE-2021-1820</a>, CVE-2021-1825</a>, CVE-2021-1826</a>, CVE-2021-21775</a>, CVE-2021-21779</a>, CVE-2021-21806</a>, CVE-2021-30661</a>, CVE-2021-30663</a>, CVE-2021-30665</a>, CVE-2021-30666</a>, CVE-2021-30682</a>, CVE-2021-30689</a>, CVE-2021-30720</a>, CVE-2021-30734</a>, CVE-2021-30744</a>, CVE-2021-30749</a>, CVE-2021-30758</a>, CVE-2021-30761</a>, CVE-2021-30762</a>, CVE-2021-30795</a>, CVE-2021-30797</a>, CVE-2021-30799</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2021-1817</a> Versions affected: WebKitGTK and WPE WebKit before 2.30.0.</li> Credit to zhunki.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2021-1820</a> Versions affected: WebKitGTK and WPE WebKit before 2.30.0.</li> Credit to André Bargull.</li> Impact: Processing maliciously crafted web content may result in the disclosure of process memory. Description: A memory initialization issue was addressed with improved memory handling.</li> </ul> </li> CVE-2021-1825</a> Versions affected: WebKitGTK and WPE WebKit before 2.30.0.</li> Credit to Alex Camboe of Aon’s Cyber Solutions.</li> Impact: Processing maliciously crafted web content may lead to a cross site scripting attack. Description: An input validation issue was addressed with improved input validation.</li> </ul> </li> CVE-2021-1826</a> Versions affected: WebKitGTK and WPE WebKit before 2.30.0.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2021-21775</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to Marcin Towalski of Cisco Talos.</li> A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of WebKit. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage.</li> </ul> </li> CVE-2021-21779</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to Marcin Towalski of Cisco Talos.</li> A use-after-free vulnerability exists in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability.</li> </ul> </li> CVE-2021-21806</a> Versions affected: WebKitGTK and WPE WebKit before 2.30.6.</li> Credit to Marcin 'Icewall' Noga of Cisco Talos.</li> An exploitable use-after-free vulnerability exists in WebKit. A specially crafted HTML web page can cause a use-after-free condition, resulting in remote code execution. The victim needs to visit a malicious web site to trigger the vulnerability.</li> </ul> </li> CVE-2021-30661</a> Versions affected: WebKitGTK and WPE WebKit before 2.30.0.</li> Credit to yangkang(@dnpushme) of 360 ATA.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-30663</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An integer overflow was addressed with improved input validation.</li> </ul> </li> CVE-2021-30665</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2021-30666</a> Versions affected: WebKitGTK and WPE WebKit before 2.26.0.</li> Credit to yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A buffer overflow issue was addressed with improved memory handling.</li> </ul> </li> CVE-2021-30682</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.0.</li> Credit to an anonymous researcher and 1lastBr3ath.</li> Impact: A malicious application may be able to leak sensitive user information. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2021-30689</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2021-30720</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to David Schütz (@xdavidhu).</li> Impact: A malicious website may be able to access restricted ports on arbitrary servers. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2021-30734</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to Jack Dates of RET2 Systems, Inc. (@ret2systems) working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2021-30744</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to Dan Hite of jsontop.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins.</li> </ul> </li> CVE-2021-30749</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to an anonymous researcher and mipu94 of SEFCOM lab, ASU. working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2021-30758</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.2.</li> Credit to Christoph Guttandin of Media Codings.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved state handling.</li> </ul> </li> CVE-2021-30761</a> Versions affected: WebKitGTK and WPE WebKit before 2.26.0.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2021-30762</a> Versions affected: WebKitGTK and WPE WebKit before 2.28.0.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-30795</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-30797</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to code execution. Description: This issue was addressed with improved checks.</li> </ul> </li> CVE-2021-30799</a> Versions affected: WebKitGTK and WPE WebKit before 2.32.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.32.2 released! 2021-07-09T00:00:00+00:00 This is a bug fix release in the stable 2.32 series. What's new in the WebKitGTK 2.32.2 release?</h3> Improve calculation of initial WebKitWebView size.</li> Fix kinetic scrolling on touchpad with async scrolling off.</li> Fix a crash on empty drag operation in X11.</li> Fix rendering on HiDPI /4k screen and scaling.</li> Handle null native surface for for surfaceless rendering.</li> Fix JavaScriptCore crash on 32-bit big endian systems.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.33.2 released! 2021-06-08T00:00:00+00:00 This is a development release leading toward 2.34 series. What's new in the WebKitGTK 2.33.2 release?</h3> HTTP/2 support when building with libsoup3.</li> Add API to disable CORS on a web view for particular domains.</li> Fix rendering on HiDPI /4k screen and scaling.</li> Improve calculation of initial WebKitWebView size.</li> Fix rendering of VP9 with transparency.</li> Remove dependency on glvideoflip and videoflip.</li> Several fixes on scrolling when async scrolling is enabled.</li> Ensure WebKitScriptWorld::window-object-cleared signal is always emitted.</li> Translation updates: Danish, Swedish, Ukrainian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.33.1 released! 2021-05-14T00:00:00+00:00 This is the first development release leading toward 2.34 series. What's new in the WebKitGTK 2.33.1 release?</h3> Add support for CSS Scroll Snap.</li> Add support for date and datetime-local input elements.</li> Add support for ICC color management.</li> Build with libsoup3 by default.</li> Add new API to handle web process unresponsiveness.</li> Add support for link preconnect when building with libsoup3.</li> Refactored Media Source Extensions platform code to increase stability and ease support of more features in the future.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.32.1 released! 2021-05-10T00:00:00+00:00 This is the first bug fix release in the stable 2.32 series. What's new in the WebKitGTK 2.32.1 release?</h3> Support building against the Musl C library.</li> Support building against ICU version 69 or newer.</li> Improve handling of Media Capture devices.</li> Improve WebAudio playback.</li> Improve video orientation handling.</li> Improve seeking support for MSE playback.</li> Improve flush support in EME decryptors.</li> Fix HTTP status codes for requests done through a custom URI handler.</li> Fix the Bubblewrap sandbox in certain 32-bit systems.</li> Fix inconsistencies between the WebKitWebView.is-muted property state and values returned by webkit_web_view_is_playing_audio().</li> Fix the build with ENABLE_VIDEO=OFF.</li> Fix wrong timestamps for long-lived cookies.</li> Fix UI process crash when failing to load favicons.</li> Fix several crashes and rendering issues.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2021-0003 2021-03-29T00:00:00+00:00 Date Reported: March 29, 2021 </li> Advisory ID: WSA-2021-0003 </li> CVE identifiers: CVE-2021-1788</a>, CVE-2021-1844</a>, CVE-2021-1871</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2021-1788</a> Versions affected: WebKitGTK before 2.32.0 and WPE WebKit before 2.32.0.</li> Credit to Francisco Alonso (@revskills).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-1844</a> Versions affected: WebKitGTK before 2.32.0 and WPE WebKit before 2.32.0.</li> Credit to Clément Lecigne of Google’s Threat Analysis Group, Alison Huffman of Microsoft Browser Vulnerability Research.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved validation.</li> </ul> </li> CVE-2021-1871</a> Versions affected: WebKitGTK before 2.32.0 and WPE WebKit before 2.32.0.</li> Credit to an anonymous researcher.</li> Impact: A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.32.0 released! 2021-03-26T00:00:00+00:00 This is the first stable release in the 2.32 series. Highlights of the WebKitGTK 2.32.0 release</h3> NPAPI plugins support have been removed.</li> System font scaling factor is correctly applied now.</li> New permission request API for MediaKeySystem access.</li> New API to remove individual scripts/stylesheets using WebKitUserContentManager.</li> Web inspector now shows detailed information about main loop frames.</li> The minimum required GStreamer version is now 1.14.</li> The GStreamer runtime is now initialized only when required.</li> Improved platform support for WebAudio (WebAudio->MediaStream, Worklet, Multi-channel).</li> Support for hardware-accelerated video rendering on i.MX8 platforms (using the NXP driver).</li> </ul> For more details about all the changes included in WebKitGTK 2.32 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2021-0002 2021-03-22T00:00:00+00:00 Date Reported: March 22, 2021 </li> Advisory ID: WSA-2021-0002 </li> CVE identifiers: CVE-2020-27918</a>, CVE-2020-29623</a>, CVE-2020-9947</a>, CVE-2021-1765</a>, CVE-2021-1789</a>, CVE-2021-1799</a>, CVE-2021-1801</a>, CVE-2021-1870</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-27918</a> Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.</li> Credit to Liu Long of Ant Security Light-Year Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2020-29623</a> Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.</li> Credit to Simon Hunt of OvalTwo LTD.</li> Impact: A user may be unable to fully delete browsing history. Description: "Clear History and Website Data" did not clear the history in some circumstances. The issue was addressed with improved data deletion.</li> </ul> </li> CVE-2020-9947</a> Versions affected: WebKitGTK before 2.30.0 and WPE WebKit before 2.30.0.</li> Credit to cc working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2021-1765</a> Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.</li> Credit to Eliya Stein of Confiant.</li> Impact: Maliciously crafted web content may violate iframe sandboxing policy. Description: This issue was addressed with improved iframe sandbox enforcement.</li> </ul> </li> CVE-2021-1789</a> Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.</li> Credit to @S0rryMybad of 360 Vulcan Team.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved state handling.</li> </ul> </li> CVE-2021-1799</a> Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.</li> Credit to Gregory Vishnepolsky & Ben Seri of Armis Security, and Samy Kamkar.</li> Impact: A malicious website may be able to access restricted ports on arbitrary servers, Description: A port redirection issue was addressed with additional port validation.</li> </ul> </li> CVE-2021-1801</a> Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.</li> Credit to Eliya Stein of Confiant.</li> Impact: Maliciously crafted web content may violate iframe sandboxing policy. Description: This issue was addressed with improved iframe sandbox enforcement.</li> </ul> </li> CVE-2021-1870</a> Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.</li> Credit to an anonymous researcher.</li> Impact: A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.30.6 released! 2021-03-18T00:00:00+00:00 This is a bug fix release in the stable 2.30 series. What's new in the WebKitGTK 2.30.6 release?</h3> Update user agent quirks again for Google Docs and Google Drive</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.31.91 released! 2021-03-12T00:00:00+00:00 This is a development release leading toward 2.32 series. What's new in the WebKitGTK 2.31.91 release?</h3> Make WebKitSecurityOrigin a simple data store for <protocol, host, port> and deprecate webkit_security_origin_is_opaque().</li> Fix user agent again to work on several google websites.</li> Fix web view url on web process terminate signals.</li> Fix preferred language overrides sent to the web process.</li> Fix the build in i386.</li> Translation updates: Simplified Chinese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.31.90 released! 2021-02-26T00:00:00+00:00 This is a development release leading toward 2.32 series. What's new in the WebKitGTK 2.31.90 release?</h3> Add permission request API for MediaKeySystem access.</li> Fix rendering when using opacity filters on hardware accelerated layers.</li> Fix flatpak-spawn subsandbox to not clear environment variables.</li> Ensure a URI scheme handler can't be registered multiple times.</li> Fix several crashes and rendering issues.</li> The minimum required GStreamer version is now 1.14.</li> CEA-608 closed captions support (requires WEBKIT_GST_USE_PLAYBIN3=1 environment variable).</li> Advertise CBCS decryption and VP9 support in Thunder.</li> Advertise DASH as supported in the media player.</li> Improved support for playbin3.</li> Translation updates: Ukrainian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2021-0001 2021-02-15T00:00:00+00:00 Date Reported: February 15, 2021 </li> Advisory ID: WSA-2021-0001 </li> CVE identifiers: CVE-2020-13558</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-13558</a> Versions affected: WebKitGTK before 2.30.5 and WPE WebKit before 2.30.5.</li> Credit to Marcin 'Icewall' Noga of Cisco Talos.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue in the AudioSourceProviderGStreamer class was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.30.5 released! 2021-02-11T00:00:00+00:00 This is a bug fix release in the stable 2.30 series. What's new in the WebKitGTK 2.30.5 release?</h3> Bring back the WebKitPluginProcess intallation that was removed by mistake.</li> Fix RunLoop objects leaked in worker threads.</li> Fix aarch64 llint build with JIT disabled.</li> Use Internet Explorer quirk for Google Docs.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.31.1 released! 2021-01-12T00:00:00+00:00 This is the first development release leading toward 2.32 series. What's new in the WebKitGTK 2.31.1 release?</h3> Remove support for NPAPI plugins.</li> Enable the web process cache when PSON is enabled too.</li> TLS errors and proxy settings APIs have been moved from WebKitContext to WebKitWebsiteDataManager.</li> Add new API to remove individual scripts/stylesheets using WebKitUserContentManager.</li> Correctly apply the system font scaling factor.</li> Show main loop frames information in the web inspector.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.30.4 released! 2020-12-15T00:00:00+00:00 This is a bug fix release in the stable 2.30 series. What's new in the WebKitGTK 2.30.4 release?</h3> Fix text data sent with WebSockets when using libsoup < 2.68.</li> Fix the rendering on Raspberry Pi 3 using the proprietary video driver.</li> Fix clipping of descedant layers of a mask layer.</li> Fix the build with ICU 68.1.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0009 2020-11-30T00:00:00+00:00 Date Reported: November 30, 2020 </li> Advisory ID: WSA-2020-0009 </li> CVE identifiers: CVE-2020-13543</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-13543</a> Versions affected: WebKitGTK before 2.30.3 and WPE WebKit before 2.30.3.</li> Credit to Marcin 'Icewall' Noga of Cisco Talos.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0008 2020-11-23T00:00:00+00:00 Date Reported: November 23, 2020 </li> Advisory ID: WSA-2020-0008 </li> CVE identifiers: CVE-2020-13584</a>, CVE-2020-9948</a>, CVE-2020-9951</a>, CVE-2020-9952</a>, CVE-2020-9983</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-13584</a> Versions affected: WebKitGTK before 2.30.3 and WPE WebKit before 2.30.3.</li> Credit to Marcin 'Icewall' Noga of Cisco Talos.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2020-9948</a> Versions affected: WebKitGTK before 2.30.0 and WPE WebKit before 2.30.0.</li> Credit to Brendan Draper (@6r3nd4n) working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2020-9951</a> Versions affected: WebKitGTK before 2.30.0 and WPE WebKit before 2.30.0.</li> Credit to Marcin 'Icewall' Noga of Cisco Talos.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2020-9952</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to Ryan Pickren (ryanpickren.com).</li> Impact: Processing maliciously crafted web content may lead to a cross site scripting attack. Description: An input validation issue was addressed with improved input validation.</li> </ul> </li> CVE-2020-9983</a> Versions affected: WebKitGTK before 2.30.3 and WPE WebKit before 2.30.3.</li> Credit to zhunki.</li> Impact: Processing maliciously crafted web content may lead to code execution. Description: An out-of-bounds write issue was addressed with improved bounds checking.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.30.3 released! 2020-11-20T00:00:00+00:00 This is a bug fix release in the stable 2.30 series. What's new in the WebKitGTK 2.30.3 release?</h3> Add new build option USE(64KB_PAGE_BLOCK).</li> Fix backdrop filters with rounded borders.</li> Fix scrolling iframes when async scrolling is enabled.</li> Allow applications to handle drag and drop on the web view again.</li> Update Outlook user agent quirk.</li> Fix the build with video support disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.30.2 released! 2020-10-23T00:00:00+00:00 This is a bug fix release in the stable 2.30 series. What's new in the WebKitGTK 2.30.2 release?</h3> Fix scrolling when smooth scrolling is enabled in async scrolling mode.</li> Fix WebSocket requests with same-site cookies.</li> Fix TLS certificate information for service workers.</li> Handle chassis type when its value is quoted.</li> Fix the build with ENABLE_MEDIA_STREAM enabled and ENABLE_WEB_RTC_DISABLED.</li> Fix the build with ENABLE_GAMEPAD enabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.30.1 released! 2020-09-21T00:00:00+00:00 This is the first bug fix release in the stable 2.30 series. What's new in the WebKitGTK 2.30.1 release?</h3> Bring back the environment variable to force single process mode when PSON is disabled.</li> Fix downloads started by an ephemeral web context.</li> Translation updates: Brazilian Portuguese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.30.0 released! 2020-09-11T00:00:00+00:00 This is the first stable release in the 2.30 series. Highlights of the WebKitGTK 2.30.0 release</h3> Add Intelligent Tracking Prevention (ITP) support.</li> Add support for backdrop filters.</li> Stop using GTK theming to render form controls and add API to disable using GTK to render scrollbars too.</li> Add support for video formats in image elements.</li> Add API to handle video autoplay policy that now defaults to disallow autoplay videos with audio.</li> Add API to mute a web view.</li> Add paste as plain text option to the context menu for rich editable content.</li> </ul> For more details about all the changes included in WebKitGTK 2.30 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.29.92 released! 2020-09-04T00:00:00+00:00 This is a development release leading toward 2.30 series. What's new in the WebKitGTK 2.29.92 release?</h3> Fix user agent header after a redirect when a new quirk is required.</li> Stop using firefox user agent quirk for google docs.</li> Fix rendering frames timeline panel in web inspector.</li> Fix per-thread cpu usage in web inspector.</li> Fix several crashes and rendering issues.</li> Translation updates: Polish</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.29.90 released! 2020-08-14T00:00:00+00:00 This is a development release leading toward 2.30 series. What's new in the WebKitGTK 2.29.90 release?</h3> Fix font variation settings when font smoothing setting is also present.</li> Fix HTML drag and drop operations.</li> Fix argument order for clone syscall seccomp filter on s390x.</li> Fix a crash when selecting text.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.29.91 released! 2020-08-14T00:00:00+00:00 This is a development release leading toward 2.30 series. What's new in the WebKitGTK 2.29.91 release?</h3> Fix a web process crash introduced in 2.29.90.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.29.4 released! 2020-07-29T00:00:00+00:00 This is a development release leading toward 2.30 series. What's new in the WebKitGTK 2.29.4 release?</h3> Add support for backdrop filters.</li> Add support for text-underline-offset and text-decoration-thickness.</li> Add OpenCDM and AV1 support to media backend.</li> Add new API to get ITP data summary.</li> Use mobile user-agent on tablets.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0007 2020-07-29T00:00:00+00:00 Date Reported: July 29, 2020 </li> Advisory ID: WSA-2020-0007 </li> CVE identifiers: CVE-2020-9862</a>, CVE-2020-9893</a>, CVE-2020-9894</a>, CVE-2020-9895</a>, CVE-2020-9915</a>, CVE-2020-9925</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-9862</a> Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4.</li> Credit to Ophir Lojkine (@lovasoa).</li> Impact: Copying a URL from Web Inspector may lead to command injection. Description: A command injection issue existed in Web Inspector. This issue was addressed with improved escaping.</li> </ul> </li> CVE-2020-9893</a> Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4.</li> Credit to 0011 working with Trend Micro Zero Day Initiative.</li> Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution. Description: An use-after-free issue was addressed with improved memory management.</li> </ul> </li> CVE-2020-9894</a> Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4.</li> Credit to 0011 working with Trend Micro Zero Day Initiative.</li> Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution. Description: An out-of-bounds read was addressed with improved input validation.</li> </ul> </li> CVE-2020-9895</a> Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4.</li> Credit to Wen Xu of SSLab, Georgia Tech.</li> Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution. Description: An use-after-free issue was addressed with improved memory management.</li> </ul> </li> CVE-2020-9915</a> Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4.</li> Credit to Ayoub AIT ELMOKHTAR of Noon.</li> Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions.</li> </ul> </li> CVE-2020-9925</a> Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.28.4 released! 2020-07-28T00:00:00+00:00 This is a bug fix release in the stable 2.28 series. What's new in the WebKitGTK 2.28.4 release?</h3> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0006 2020-07-10T00:00:00+00:00 Date Reported: July 10, 2020 </li> Advisory ID: WSA-2020-0006 </li> CVE identifiers: CVE-2020-9802</a>, CVE-2020-9803</a>, CVE-2020-9805</a>, CVE-2020-9806</a>, CVE-2020-9807</a>, CVE-2020-9843</a>, CVE-2020-9850</a>, CVE-2020-13753</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-9802</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to Samuel Groß of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2020-9803</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to Wen Xu of SSLab at Georgia Tech.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved validation.</li> </ul> </li> CVE-2020-9805</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2020-9806</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to Wen Xu of SSLab at Georgia Tech.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2020-9807</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to Wen Xu of SSLab at Georgia Tech.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2020-9843</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to Ryan Pickren (ryanpickren.com).</li> Impact: Processing maliciously crafted web content may lead to a cross site scripting attack. Description: An input validation issue was addressed with improved input validation.</li> </ul> </li> CVE-2020-9850</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to @jinmo123, @setuid0x0_, and @insu_yun_en of @SSLab_Gatech working with Trend Micro’s Zero Day Initiative.</li> Impact: A remote attacker may be able to cause arbitrary code execution. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2020-13753</a> Versions affected: WebKitGTK before 2.28.3 and WPE WebKit before 2.28.3.</li> Credit to Milan Crha at Red Hat.</li> The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.28.3 released! 2020-07-09T00:00:00+00:00 This is a bug fix release in the stable 2.28 series. What's new in the WebKitGTK 2.28.3 release?</h3> Enable kinetic scrolling with async scrolling.</li> Fix web process hangs on large GitHub pages.</li> Bubblewrap sandbox should not attempt to bind empty paths.</li> Fix threading issues in the media player.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.29.3 released! 2020-07-08T00:00:00+00:00 This is a development release leading toward 2.30 series. What's new in the WebKitGTK 2.29.3 release?</h3> Add webkit_authentication_request_get_security_origin.</li> Change the cookies accept policy to always when no-third-party is set and ITP is enabled.</li> Fix web process hangs on large GitHub pages.</li> Bubblewrap sandbox should not attempt to bind empty paths.</li> Add support for sndio to bubblewrap sandbox.</li> Also handle dark themes when the name ends with -Dark.</li> Fix a race condition causing a crash in media player.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.29.2 released! 2020-06-24T00:00:00+00:00 This is a development release leading toward 2.30 series. What's new in the WebKitGTK 2.29.2 release?</h3> Add Intelligent Tracking Prevention (ITP) support.</li> Add support for video formats in img elements.</li> Add API to handle video autoplay policy that now defaults to disallow autoplay videos with audio.</li> Add API to mute a web view.</li> Add API to allow applications to handle the HTTP authentication credential storage.</li> Add a WebKitSetting to set the media content types requiring hardware support.</li> Fix a crash during drag an drop due to a bug introduced in 2.29.1.</li> Do not start page load during animation in back/forward gesture.</li> Fix several crashes and rendering issues.</li> Translation updates: Ukrainian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.29.1 released! 2020-05-18T00:00:00+00:00 This is the first development release leading toward 2.30 series. What's new in the WebKitGTK 2.29.1 release?</h3> Stop using GTK theming to render form controls.</li> Add API to disable GTK theming for scrollbars too.</li> Fix several race conditions and threading issues in the media player.</li> Add USER_AGENT_BRANDING build option.</li> Add paste as plain text option to the context menu for rich editable content.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0005 2020-04-27T00:00:00+00:00 Date Reported: April 27, 2020 </li> Advisory ID: WSA-2020-0005 </li> CVE identifiers: CVE-2020-3885</a>, CVE-2020-3894</a>, CVE-2020-3895</a>, CVE-2020-3897</a>, CVE-2020-3899</a>, CVE-2020-3900</a>, CVE-2020-3901</a>, CVE-2020-3902</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-3885</a> Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before 2.28.0.</li> Credit to Ryan Pickren (ryanpickren.com).</li> Impact: A file URL may be incorrectly processed. Description: A logic issue was addressed with improved restrictions.</li> </ul> </li> CVE-2020-3894</a> Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before 2.28.0.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: An application may be able to read restricted memory. Description: A race condition was addressed with additional validation.</li> </ul> </li> CVE-2020-3895</a> Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before 2.28.0.</li> Credit to grigoritchy.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2020-3897</a> Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before 2.28.0.</li> Credit to Brendan Draper (@6r3nd4n) working with Trend Micro’s Zero Day Initiative.</li> Impact: A remote attacker may be able to cause arbitrary code execution. Description: A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2020-3899</a> Versions affected: WebKitGTK before 2.28.2 and WPE WebKit before 2.28.2.</li> Credit to OSS-Fuzz.</li> Impact: A remote attacker may be able to cause arbitrary code execution. Description: A memory consumption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2020-3900</a> Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before 2.28.0.</li> Credit to Dongzhuo Zhao working with ADLab of Venustech.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2020-3901</a> Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before 2.28.0.</li> Credit to Benjamin Randazzo (@____benjamin).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2020-3902</a> Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before 2.28.0.</li> Credit to Yiğit Can YILMAZ (@yilmazcanyigit).</li> Impact: Processing maliciously crafted web content may lead to a cross site scripting attack. Description: An input validation issue was addressed with improved input validation.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.28.2 released! 2020-04-24T00:00:00+00:00 This is a bug fix release in the stable 2.28 series. What's new in the WebKitGTK 2.28.2 release?</h3> Fix excessive CPU usage due to GdkFrameClock not being stopped.</li> Fix UI process crash when EGL_WL_bind_wayland_display extension is not available.</li> Fix position of select popup menus in X11.</li> Fix playing of Youtube 'live stream'/H264 URLs.</li> Fix a crash under X11 when cairo uses xcb.</li> Fix the build in MIPS64.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0004 2020-04-16T00:00:00+00:00 Date Reported: April 16, 2020 </li> Advisory ID: WSA-2020-0004 </li> CVE identifiers: CVE-2020-11793</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-11793</a> Versions affected: WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1.</li> Credit to Cim Stordal of Cognite.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or application crash (denial of service). Description: A memory corruption issue (use-after-free) was addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.28.1 released! 2020-04-13T00:00:00+00:00 This is the first bug fix release in the stable 2.28 series. What's new in the WebKitGTK 2.28.1 release?</h3> Fix position of default option element popup windows under Wayland.</li> Fix rendering after a cross site navigation with PSON enabled and hardware acceleration forced.</li> Fix a crash in nested wayland compositor when closing a tab with PSON enabled.</li> Update Chrome and Firefox versions in user agent quirks.</li> Fix a crash with bubblewrap sandbox enabled.</li> Fix a crash in JavaScriptCore in ppc64el.</li> Fix the build with GStreamer 1.12.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0003 2020-03-12T00:00:00+00:00 Date Reported: March 12, 2020 </li> Advisory ID: WSA-2020-0003 </li> CVE identifiers: CVE-2020-10018</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-10018</a> Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before 2.28.0.</li> Credit to Sudhakar Verma, Ashfaq Ansari & Siddhant Badhe - Project Srishti of CloudFuzz.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue (use-after-free) was addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.28.0 released! 2020-03-10T00:00:00+00:00 This is the first stable release in the 2.28 series. Highlights of the WebKitGTK 2.28.0 release</h3> Add API to enable Process Swap on (Cross-site) Navigation.</li> Add user messages API for the communication with the web extension.</li> Add support for same-site cookies.</li> Service workers are enabled by default.</li> Add support for Pointer Lock API.</li> Add flatpak sandbox support.</li> Make ondemand hardware acceleration policy never leave accelerated compositing mode.</li> Always use a light theme for rendering form controls.</li> Add about:gpu to show information about the graphics stack.</li> </ul> For more details about all the changes included in WebKitGTK 2.28 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.27.91 released! 2020-02-27T00:00:00+00:00 This is a development release leading toward 2.28 series. What's new in the WebKitGTK 2.27.91 release?</h3> Update user agent quirks to fix the unsupported browser message in several google services.</li> Fix several compile warnings with GCC 10.</li> Fix the build with GCC 10.</li> Fix several crashes and rendering issues.</li> Translation updates: Chinese</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.26.4 released! 2020-02-14T00:00:00+00:00 This is a bug fix release in the stable 2.26 series. What's new in the WebKitGTK 2.26.4 release?</h3> Always use a light theme for rendering form controls.</li> Fix the build with WPE renderer disabled.</li> Fix the build with OpenGL disabled.</li> Fix the build with GCC 10.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0002 2020-02-14T00:00:00+00:00 Date Reported: February 14, 2020 </li> Advisory ID: WSA-2020-0002 </li> CVE identifiers: CVE-2020-3862</a>, CVE-2020-3864</a>, CVE-2020-3865</a>, CVE-2020-3867</a>, CVE-2020-3868</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2020-3862</a> Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before 2.26.4.</li> Credit to Srikanth Gatta of Google Chrome.</li> Impact: A malicious website may be able to cause a denial of service. Description: A denial of service issue was addressed with improved memory handling.</li> </ul> </li> CVE-2020-3864</a> Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before 2.26.4.</li> Credit to Ryan Pickren (ryanpickren.com).</li> Impact: A DOM object context may not have had a unique security origin. Description: A logic issue was addressed with improved validation.</li> </ul> </li> CVE-2020-3865</a> Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before 2.26.4.</li> Credit to Ryan Pickren (ryanpickren.com).</li> Impact: A top-level DOM object context may have incorrectly been considered secure. Description: A logic issue was addressed with improved validation.</li> </ul> </li> CVE-2020-3867</a> Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before 2.26.4.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2020-3868</a> Versions affected: WebKitGTK before 2.26.4 and WPE WebKit before 2.26.4.</li> Credit to Marcin Towalski of Cisco Talos.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.27.90 released! 2020-02-10T00:00:00+00:00 This is a development release leading toward 2.28 series. What's new in the WebKitGTK 2.27.90 release?</h3> Add support for same-site cookies.</li> Add flatpak sandbox support.</li> Enable WebAudio and WebGL by default in WebKitSettings.</li> Add a setting to disallow top level navigation to a data URI.</li> Add support for the -webkit-font-smoothing CSS property.</li> Always use a light theme for rendering form controls.</li> Stop making the Web Inspector windows transient.</li> Ensure mouse cursor is hidden during fullscreen video playback.</li> Add support for inspecting service workers to the remote inspector.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2020-0001 2020-01-23T00:00:00+00:00 Date Reported: January 23, 2020 </li> Advisory ID: WSA-2020-0001 </li> CVE identifiers: CVE-2019-8835</a>, CVE-2019-8844</a>, CVE-2019-8846</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2019-8835</a> Versions affected: WebKitGTK before 2.26.3 and WPE WebKit before 2.26.3.</li> Credit to Anonymous working with Trend Micro's Zero Day Initiative, Mike Zhang of Pangu Team.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8844</a> Versions affected: WebKitGTK before 2.26.3 and WPE WebKit before 2.26.3.</li> Credit to William Bowling (@wcbowling).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8846</a> Versions affected: WebKitGTK before 2.26.3 and WPE WebKit before 2.26.3.</li> Credit to Marcin Towalski of Cisco Talos.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.26.3 released! 2020-01-22T00:00:00+00:00 This is a bug fix release in the stable 2.26 series. What's new in the WebKitGTK 2.26.3 release?</h3> Fix issues while trying to play a video on NextCloud.</li> Make sure the GL video sink uses a valid WebKit shared GL context.</li> Fix vertical alignment of text containing arabic diacritics.</li> Fix build with icu 65.1.</li> Fix page loading errors with websites using HSTS.</li> Fix web process crash when displaying a KaTeX formula.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.27.4 released! 2020-01-10T00:00:00+00:00 This is a development release leading toward 2.28 series. What's new in the WebKitGTK 2.27.4 release?</h3> Add API for input methods.</li> Add API to serialize/deserialize a JSCValue to/from a JSON string.</li> Add support for strict secure cookies.</li> Add support for saving data from remote inspector.</li> Make ondemand hardware acceleration policy never leave accelerated compositing mode.</li> Fix rendering of conic gradients in high resolution displays.</li> Fix special combination characters not respecting the keystroke order when high CPU load.</li> Honor the IndexedDB directory set in WebsiteDataManager.</li> Fix rendering of text when there's an initial advance in the text run.</li> Fix web process crash when displaying a KaTeX formula.</li> Fix network process crash with PSON enabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.27.3 released! 2019-11-26T00:00:00+00:00 This is a development release leading toward 2.28 series. What's new in the WebKitGTK 2.27.3 release?</h3> Add support for Pointer Lock API.</li> Improve performance when falling back to system fonts.</li> Stop using DBus for the remote inspector implementation to improve the performance of both WebDriver and remote inspector.</li> Implement support for new ARIA roles: code, strong, emphasis, generic.</li> Fix handling of content type with new custom protocols implementation.</li> Make image decoders fully thread safe.</li> Add support for get page source command in WebDriver.</li> Add support for network proxy capabilities in WebDriver.</li> Add support for new window command in WebDriver.</li> Fix several crashes and rendering issues.</li> Translation updates: Brazilian Portuguese, Ukrainian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2019-0006 2019-11-08T00:00:00+00:00 Date Reported: November 08, 2019 </li> Advisory ID: WSA-2019-0006 </li> CVE identifiers: CVE-2019-8710</a>, CVE-2019-8743</a>, CVE-2019-8764</a>, CVE-2019-8765</a>, CVE-2019-8766</a>, CVE-2019-8782</a>, CVE-2019-8783</a>, CVE-2019-8808</a>, CVE-2019-8811</a>, CVE-2019-8812</a>, CVE-2019-8813</a>, CVE-2019-8814</a>, CVE-2019-8815</a>, CVE-2019-8816</a>, CVE-2019-8819</a>, CVE-2019-8820</a>, CVE-2019-8821</a>, CVE-2019-8822</a>, CVE-2019-8823</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2019-8710</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to found by OSS-Fuzz.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8743</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to zhunki from Codesafe Team of Legendsec at Qi'anxin Group.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8764</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2019-8765</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Samuel Groß of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8766</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to found by OSS-Fuzz.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8782</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to Cheolung Lee of LINE+ Security Team.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8783</a> Versions affected: WebKitGTK before 2.26.1 and WPE WebKit before 2.26.1.</li> Credit to Cheolung Lee of LINE+ Graylab Security Team.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8808</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to found by OSS-Fuzz.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8811</a> Versions affected: WebKitGTK before 2.26.1 and WPE WebKit before 2.26.1.</li> Credit to Soyeon Park of SSLab at Georgia Tech.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8812</a> Versions affected: WebKitGTK before 2.26.2 and WPE WebKit before 2.26.2.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8813</a> Versions affected: WebKitGTK before 2.26.1 and WPE WebKit before 2.26.1.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2019-8814</a> Versions affected: WebKitGTK before 2.26.2 and WPE WebKit before 2.26.2.</li> Credit to Cheolung Lee of LINE+ Security Team.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8815</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8816</a> Versions affected: WebKitGTK before 2.26.1 and WPE WebKit before 2.26.1.</li> Credit to Soyeon Park of SSLab at Georgia Tech.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8819</a> Versions affected: WebKitGTK before 2.26.1 and WPE WebKit before 2.26.1.</li> Credit to Cheolung Lee of LINE+ Security Team.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8820</a> Versions affected: WebKitGTK before 2.26.1 and WPE WebKit before 2.26.1.</li> Credit to Samuel Groß of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8821</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8822</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8823</a> Versions affected: WebKitGTK before 2.26.1 and WPE WebKit before 2.26.1.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.26.2 released! 2019-11-06T00:00:00+00:00 This is a bug fix release in the stable 2.26 series. What's new in the WebKitGTK 2.26.2 release?</h3> Improve performance of querying system fallback fonts.</li> Don't use prgname in dbus-proxy socket path.</li> Fix thread-safety issues in image decoders.</li> Fix the build with WebDriver disabled.</li> Disable accelerated compositing when we fail to initialize the EGL dispaly under Wayland.</li> Fill the objects category in emoji picker.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2019-0005 2019-10-29T00:00:00+00:00 Date Reported: October 29, 2019 </li> Advisory ID: WSA-2019-0005 </li> CVE identifiers: CVE-2019-8625</a>, CVE-2019-8674</a>, CVE-2019-8707</a>, CVE-2019-8719</a>, CVE-2019-8720</a>, CVE-2019-8726</a>, CVE-2019-8733</a>, CVE-2019-8735</a>, CVE-2019-8763</a>, CVE-2019-8768</a>, CVE-2019-8769</a>, CVE-2019-8771</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2019-8625</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2019-8674</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2019-8707</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to an anonymous researcher working with Trend Micro's Zero Day Initiative, cc working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8719</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2019-8720</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to Wen Xu of SSLab at Georgia Tech.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8726</a> Versions affected: WebKitGTK before 2.24.3 and WPE WebKit before 2.24.3.</li> Credit to Jihui Lu of Tencent KeenLab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8733</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8735</a> Versions affected: WebKitGTK before 2.24.2 and WPE WebKit before 2.24.2.</li> Credit to G. Geshev working with Trend Micro Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8763</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8768</a> Versions affected: WebKitGTK before 2.24.0 and WPE WebKit before 2.24.0.</li> Credit to Hugo S. Diaz (coldpointblue).</li> Impact: A user may be unable to delete browsing history items. Description: "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion.</li> </ul> </li> CVE-2019-8769</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to Piérre Reimertz (@reimertz).</li> Impact: Visiting a maliciously crafted website may reveal browsing history. Description: An issue existed in the drawing of web page elements. The issue was addressed with improved logic.</li> </ul> </li> CVE-2019-8771</a> Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0.</li> Credit to Eliya Stein of Confiant.</li> Impact: Maliciously crafted web content may violate iframe sandboxing policy. Description: This issue was addressed with improved iframe sandbox enforcement.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.27.2 released! 2019-10-22T00:00:00+00:00 This is a development release leading toward 2.28 series. What's new in the WebKitGTK 2.27.2 release?</h3> Add user messages API for the communication with the web extension.</li> Enable service workers by default.</li> Add support for saving data in Web Inspector.</li> More navigation gesture improvement.</li> Fix the build with WebDriver disabled.</li> Show also client EGL extensions in about:gpu.</li> Disable accelerated compositing when we fail to initialize the EGL dispaly under Wayland.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.27.1 released! 2019-10-04T00:00:00+00:00 This is the first development release leading toward 2.28 series. What's new in the WebKitGTK 2.27.1 release?</h3> Enable async scrolling when accelerating compositing policy is 'always'.</li> Add about:gpu to show information about the graphics stack.</li> Add API to enable Process Swap on (Cross-site) Navigation, that is now disabled by default.</li> Add WebKitWebView:page-id property.</li> Improve swipe navigation gesture style.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.26.1 released! 2019-09-23T00:00:00+00:00 This is the first bug fix release in the stable 2.26 series. What's new in the WebKitGTK 2.26.1 release?</h3> Fix MSE media player with GStreamer 1.14.</li> Fix HTML alternate loads never finishing.</li> Fix web view initialization delay on fisrt load.</li> Validate user agent string set via API.</li> Fix a crash when a web view is destroyed with accelerated compositing mode enabled.</li> Fix EGL initialization with newer versions of Mesa.</li> Do not enable the sandbox inside docker.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.26.0 released! 2019-09-09T00:00:00+00:00 This is the first stable release in the 2.26 series. Highlights of the WebKitGTK 2.26.0 release</h3> Add support for subprocess sandboxing.</li> Add support for HSTS (HTTP Strict Transport Security).</li> Use libwpe with fdo backend to implement accelerated compositing under wayland.</li> Remove support for GTK2 NPAPI plugins.</li> Add support for datalist element in text input fields.</li> Show the emoji chooser popover for editable content.</li> Improve rendering of form controls when GTK theme is dark.</li> Fix rendering artifacts in youtube volume button and github comment box.</li> Single process model has been deprecated for security reasons.</li> </ul> For more details about all the changes included in WebKitGTK 2.26 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.25.92 released! 2019-09-03T00:00:00+00:00 This is a development release leading toward 2.26 series. What's new in the WebKitGTK 2.25.92 release?</h3> Add WEBKIT_USE_SINGLE_WEB_PROCESS environment variable to force single process model in all WebKitWebContext. This is a temporary solution for applications still depending on the single process mode behavior. It will be only available in 2.26 series.</li> Add new API to remove a filter from an user content manager given its identifier.</li> Add support for HSTS.</li> Several improvements and bug fixes in MSE media player.</li> Fix building without unified sources.</li> Fix several crashes and rendering issues.</li> Translation updates: Polish, Ukrainian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2019-0004 2019-08-29T00:00:00+00:00 Date Reported: August 29, 2019 </li> Advisory ID: WSA-2019-0004 </li> CVE identifiers: CVE-2019-8644</a>, CVE-2019-8649</a>, CVE-2019-8658</a>, CVE-2019-8666</a>, CVE-2019-8669</a>, CVE-2019-8671</a>, CVE-2019-8672</a>, CVE-2019-8673</a>, CVE-2019-8676</a>, CVE-2019-8677</a>, CVE-2019-8678</a>, CVE-2019-8679</a>, CVE-2019-8680</a>, CVE-2019-8681</a>, CVE-2019-8683</a>, CVE-2019-8684</a>, CVE-2019-8686</a>, CVE-2019-8687</a>, CVE-2019-8688</a>, CVE-2019-8689</a>, CVE-2019-8690</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2019-8644</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to G. Geshev working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8649</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved state management.</li> </ul> </li> CVE-2019-8658</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to akayn working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved state management.</li> </ul> </li> CVE-2019-8666</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.3.</li> Credit to Zongming Wang (王宗明) and Zhe Jin (金哲) from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8669</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to akayn working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8671</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.2.</li> Credit to Apple.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8672</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.2.</li> Credit to Samuel Groß of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8673</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.3.</li> Credit to Soyeon Park and Wen Xu of SSLab at Georgia Tech.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8676</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.3.</li> Credit to Soyeon Park and Wen Xu of SSLab at Georgia Tech.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8677</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.2.</li> Credit to Jihui Lu of Tencent KeenLab.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8678</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to an anonymous researcher, Anthony Lai (@darkfloyd1014) of Knownsec, Ken Wong (@wwkenwong) of VXRL, Jeonghoon Shin (@singi21a) of Theori, Johnny Yu (@straight_blast) of VX Browser Exploitation Group, Chris Chan (@dr4g0nfl4me) of VX Browser Exploitation Group, Phil Mok (@shadyhamsters) of VX Browser Exploitation Group, Alan Ho (@alan_h0) of Knownsec, Byron Wai of VX Browser Exploitation.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8679</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.2.</li> Credit to Jihui Lu of Tencent KeenLab.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8680</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Jihui Lu of Tencent KeenLab.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8681</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.3.</li> Credit to G. Geshev working with Trend Micro Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8683</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8684</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8686</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.2.</li> Credit to G. Geshev working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8687</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.3.</li> Credit to Apple.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8688</a> Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3.</li> Credit to Insu Yun of SSLab at Georgia Tech.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8689</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.3.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8690</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.3.</li> Credit to Sergei Glazunov of Google Project Zero.</li> Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue existed in the handling of document loads. This issue was addressed with improved state management.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.24.4 released! 2019-08-28T00:00:00+00:00 This is a bug fix release in the stable 2.24 series. What's new in the WebKitGTK 2.24.4 release?</h3> Updated the user agent string to make happy certain websites which would claim that the browser being used was unsupported.</li> Improve loading of multimedia streams to avoid memory exhaustion due to excessive caching.</li> Fix display of documents with MIME type application/xml in the Web Inspector, when loaded using XmlHttpRequest.</li> Fix a hang while scrolling certain websites which include HLS video content (Twitter, for example).</li> Fix rounding artifacts in volume levels for media playback.</li> Fix several crashes and rendering issues.</li> Fix the build with video track support disabled.</li> Fix the build with OpenGL support disabled.</li> Fix build issue which would cause media controls to disappear when Python 3.x was used during the build process.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.25.4 released! 2019-08-02T00:00:00+00:00 This is a development release leading toward 2.26 series. What's new in the WebKitGTK 2.25.4 release?</h3> Switch to use libsoup WebSockets API.</li> Add support for permessage-deflate WebSocket extension.</li> Add support for datalist element in text input fields.</li> Fix a crash with empty video source.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.25.3 released! 2019-07-23T00:00:00+00:00 This is a development release leading toward 2.26 series. What's new in the WebKitGTK 2.25.3 release?</h3> Remove support for GTK2 NPAPI plugins.</li> Fix web view updates after swapping web process if accelerated compositing mode is forced.</li> Make kinetic scrolling work again.</li> Fix position of emoji chooser when page is scrolled.</li> Fix web process deadlock when scrolling twitter timeline which contains HLS videos.</li> Make navigation gesture use dark fallback background color color on dark themes.</li> Make Previous/Next gesture work in RTL mode.</li> Support cancelling touchscreen back/forward gesture.</li> Add user agent quirk to make github work in FreeBSD.</li> Fix content disappearing when using CSS transforms.</li> Fix some radio streams that could not be played.</li> Fix video pause that sometimes caused to skip to finish.</li> Fix volume level changes when playing a video.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.24.3 released! 2019-07-02T00:00:00+00:00 This is a bug fix release in the stable 2.24 series. What's new in the WebKitGTK 2.24.3 release?</h3> Deprecate WebSQL APIs.</li> Make Previous/Next gesture work in RTL mode.</li> Fix content disappearing when using CSS transforms.</li> Fix rendering artifacts in youtube volume button.</li> Fix trapezoid artifact in github comment box.</li> Fix video pause that sometimes caused to skip to finish.</li> Fix volume level changes when playing a video.</li> Fix HLS streams being slow to start.</li> Fix some radio streams that could not be played.</li> Fix the build with older versions of GStreamer.</li> Fix the build with video and audio disabled.</li> Fix several crashes and rendering issues.</li> Translation updates: Brazilian Portuguese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.25.2 released! 2019-06-17T00:00:00+00:00 This is a development release leading toward 2.26 series. What's new in the WebKitGTK 2.25.2 release?</h3> Enable process switch on cross site navigation.</li> Use libwpe with fdo backend to implement accelerated compositing under wayland.</li> Fix rendering artifacts in youtube volume button.</li> Fix trapezoid artifact in github comment box.</li> Ensure web extensions directory is readable when sandbox is enabled.</li> Fix the executable name of WebDriver process, renamed by mistake in 2.25.1.</li> Enable hyperlink auditing setting by default.</li> Remove the option to build without using the redirected XComposite window.</li> Fix HLS streams being slow to start.</li> Make accessibility work when sandbox is enabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.25.1 released! 2019-05-27T00:00:00+00:00 This is the first development release leading toward 2.26 series. What's new in the WebKitGTK 2.25.1 release?</h3> Add support for subprocess sandboxing.</li> Add API to get the web process unique identifier of a WebKitFrame.</li> Add WebKitWebPage::did-associate-form-controls-for-frame signal and deprecate did-associate-form-controls.</li> Implement AtkComponentIface scroll_to methods.</li> Improve rendering of form controls when GTK theme is dark and enable prefers-color-scheme media query.</li> Show the emoji chooser popover for editable content.</li> Fix touch capabilities detection for websites checking touch events properties present in window or pointer media queries.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2019-0003 2019-05-20T00:00:00+00:00 Date Reported: May 20, 2019 </li> Advisory ID: WSA-2019-0003 </li> CVE identifiers: CVE-2019-6237</a>, CVE-2019-8571</a>, CVE-2019-8583</a>, CVE-2019-8584</a>, CVE-2019-8586</a>, CVE-2019-8587</a>, CVE-2019-8594</a>, CVE-2019-8595</a>, CVE-2019-8596</a>, CVE-2019-8597</a>, CVE-2019-8601</a>, CVE-2019-8607</a>, CVE-2019-8608</a>, CVE-2019-8609</a>, CVE-2019-8610</a>, CVE-2019-8615</a>, CVE-2019-8611</a>, CVE-2019-8619</a>, CVE-2019-8622</a>, CVE-2019-8623</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2019-6237</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to G. Geshev working with Trend Micro Zero Day Initiative, Liu Long of Qihoo 360 Vulcan Team.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8571</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to 01 working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8583</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to sakura of Tencent Xuanwu Lab, jessica (@babyjess1ca_) of Tencent Keen Lab, and dwfault working at ADLab of Venustech.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8584</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to G. Geshev of MWR Labs working with Trend Micro Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8586</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to an anonymous researcher.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8587</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to G. Geshev working with Trend Micro Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8594</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Suyoung Lee and Sooel Son of KAIST Web Security & Privacy Lab and HyungSeok Han and Sang Kil Cha of KAIST SoftSec Lab.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8595</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.2.</li> Credit to G. Geshev from MWR Labs working with Trend Micro Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8596</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to Wen Xu of SSLab at Georgia Tech.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8597</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to 01 working with Trend Micro Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8601</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to Fluoroacetate working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8607</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.2.</li> Credit to Junho Jang and Hanul Choi of LINE Security Team.</li> Processing maliciously crafted web content may result in the disclosure of process memory. An out-of-bounds read was addressed with improved input validation.</li> </ul> </li> CVE-2019-8608</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to G. Geshev working with Trend Micro Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8609</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Wen Xu of SSLab, Georgia Tech.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8610</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to Anonymous working with Trend Micro Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8615</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.2.</li> Credit to G. Geshev from MWR Labs working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8611</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Samuel Groß of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8619</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to Wen Xu of SSLab at Georgia Tech and Hanqing Zhao of Chaitin Security Research Lab.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8622</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Samuel Groß of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8623</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Samuel Groß of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.24.2 released! 2019-05-17T00:00:00+00:00 This is a bug fix release in the stable 2.24 series. What's new in the WebKitGTK 2.24.2 release?</h3> Fix rendering of emojis copy-pasted from GTK emoji chooser.</li> Fix space characters not being rendered with some CJK fonts.</li> Fix adaptive streaming playback with older GStreamer versions.</li> Set a maximum zoom level for pinch zooming gesture.</li> Fix navigation gesture to not interfere with scrolling.</li> Fix SSE2 detection at compile time, ensuring the right flags are passed to the compiler.</li> Fix several crashes and rendering issues.</li> Translation updates: Danish, Spanish, Ukrainian.</li> Security fixes: CVE-2019-8595</a>, CVE-2019-8607</a>, CVE-2019-8615</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK and WPE WebKit Security Advisory WSA-2019-0002 2019-04-10T00:00:00+00:00 Date Reported: April 10, 2019 </li> Advisory ID: WSA-2019-0002 </li> CVE identifiers: CVE-2019-6201</a>, CVE-2019-6251</a>, CVE-2019-7285</a>, CVE-2019-7292</a>, CVE-2019-8503</a>, CVE-2019-8506</a>, CVE-2019-8515</a>, CVE-2019-8518</a>, CVE-2019-8523</a>, CVE-2019-8524</a>, CVE-2019-8535</a>, CVE-2019-8536</a>, CVE-2019-8544</a>, CVE-2019-8551</a>, CVE-2019-8558</a>, CVE-2019-8559</a>, CVE-2019-8563</a>, CVE-2019-11070</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2019-6201</a> Versions affected: WebKitGTK before 2.22.6 and WPE WebKit before 2.22.4.</li> Credit to dwfault working with ADLab of Venustech.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-6251</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to Dhiraj.</li> Processing maliciously crafted web content may lead to spoofing. WebKitGTK and WPE WebKit were vulnerable to a URI spoofing attack similar to the CVE-2018-8383 issue in Microsoft Edge.</li> </ul> </li> CVE-2019-7285</a> Versions affected: WebKitGTK before 2.22.6 and WPE WebKit before 2.22.4.</li> Credit to dwfault working at ADLab of Venustech.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2019-7292</a> Versions affected: WebKitGTK before 2.22.6 and WPE WebKit before 2.22.4.</li> Credit to Zhunki and Zhiyi Zhang of 360 ESG Codesafe Team.</li> Processing maliciously crafted web content may result in the disclosure of process memory. A validation issue was addressed with improved logic.</li> </ul> </li> CVE-2019-8503</a> Versions affected: WebKitGTK before 2.22.6 and WPE WebKit before 2.22.4.</li> Credit to Linus Särud of Detectify.</li> A malicious website may be able to execute scripts in the context of another website. A logic issue was addressed with improved validation.</li> </ul> </li> CVE-2019-8506</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Samuel Groß of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2019-8515</a> Versions affected: WebKitGTK before 2.22.6 and WPE WebKit before 2.22.4.</li> Credit to James Lee, @Windowsrcer.</li> Processing maliciously crafted web content may disclose sensitive user information. A cross-origin issue existed with the fetch API. This was addressed with improved input validation.</li> </ul> </li> CVE-2019-8518</a> Versions affected: WebKitGTK before 2.22.7 and WPE WebKit before 2.22.5.</li> Credit to Samuel Groß of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8523</a> Versions affected: WebKitGTK before 2.22.7 and WPE WebKit before 2.22.5.</li> Credit to Apple.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8524</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to G. Geshev working with Trend Micro Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8535</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Zhiyang Zeng, @Wester, of Tencent Blade Team.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2019-8536</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Apple.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2019-8544</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to an anonymous researcher.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2019-8551</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Ryan Pickren, ryanpickren.com.</li> Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.</li> </ul> </li> CVE-2019-8558</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Samuel Groß of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8559</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Apple.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-8563</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.0.</li> Credit to Apple.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-11070</a> Versions affected: WebKitGTK and WPE WebKit before 2.24.1.</li> Credit to Igalia.</li> WebKitGTK and WPE WebKit failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK 2.24.1 released! 2019-04-09T00:00:00+00:00 This is the first bug fix release in the stable 2.24 series. What's new in the WebKitGTK 2.24.1 release?</h3> Do not allow changes in active URI before provisional load starts for non-API requests.</li> Stop the threaded compositor when the page is not visible or layer tree state is frozen.</li> Use WebKit HTTP source element again for adaptive streaming fragments downloading.</li> Properly handle empty resources in webkit_web_resource_get_data().</li> Add quirk to ensure outlook.live.com uses the modern UI.</li> Fix methods returing GObject or boxed types in JavaScriptCore GLib API.</li> Ensure callback data is passed to functions and constructors with no parameters in JavaScriptCore GLib API.</li> Fix rendering of complex text when the font uses x,y origins.</li> Fix sound loop with Google Hangouts and WhatsApp notifications.</li> Fix the build with GStreamer 1.12.5 and GST GL enabled.</li> Detect SSE2 at compile time.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2019-6251</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.24.0 released! 2019-03-13T00:00:00+00:00 This is the first stable release in the 2.24 series. Highlights of the WebKitGTK 2.24.0 release</h3> Added support for content filtering.</li> Variation fonts support.</li> Fully emoji rendering support.</li> Added navigation and pinch zoom gestures for touchpads.</li> Support for JPEG2000 images.</li> Script dialogs are now modal to the current web view only.</li> New API to convert URI to format for display.</li> </ul> For more details about all the changes included in WebKitGTK 2.24 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK 2.23.92 released! 2019-03-06T00:00:00+00:00 This is a development release leading toward 2.24 series. What's new in the WebKitGTK 2.23.92 release?</h3> Fix constructors returning a GObject in JSC GLib API.</li> Do not scan NPAPI plugins when plugins are disabled in settings.</li> Add WebKitUserContentFilterStore to the API docs.</li> Fix several crashes and rendering issues.</li> Translation updates: Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.22.7 released! 2019-03-01T00:00:00+00:00 This is a bug fix release in the stable 2.22 series. What's new in the WebKitGTK 2.22.7 release?</h3> Fix rendering of glyphs in Hebrew (and possibly other languages) when Unicode NFC normalization is used.</li> Fix several crashes and race conditions.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.23.91 released! 2019-02-20T00:00:00+00:00 This is a development release leading toward 2.24 series. What's new in the WebKitGTK 2.23.91 release?</h3> Add new API to handle user content filters.</li> Fix a UI process crash while filling selection data during drag and drop.</li> Fix deadlock on Linux/x64 between SamplingProfiler and VMTraps.</li> Fix several crashes and rendering issues.</li> Translation updates: Italian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK 2.23.90 released! 2019-02-14T00:00:00+00:00 This is a development release leading toward 2.24 series. What's new in the WebKitGTK 2.23.90 release?</h3> Add a new setting to disable JavaScript elments from documents during parsing.</li> Add new API to expose JavaScriptCore options.</li> Add support for JPEG2000 images.</li> Add support for back/forward touchpad gesture.</li> Add support for pinch zoom on touchpad.</li> Use a scrolled window in alert dialogs to handle long contents.</li> Sleep disabler now inhibits idle when a "System" sleep disabler is requested.</li> Remove experimental sandboxing support, it's not yet ready for stable release.</li> Fix a web process deadlock when starting the remote inspector.</li> Fix a crash when browsing inspector:// URI without port set.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.22.6 released! 2019-02-09T00:00:00+00:00 This is a bug fix release in the stable 2.22 series. What's new in the WebKitGTK+ 2.22.6 release?</h3> Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.</li> Fix Web inspector magnifier under Wayland.</li> Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.</li> Fix several crashes, race conditions, and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ and WPE WebKit Security Advisory WSA-2019-0001 2019-02-08T00:00:00+00:00 Date Reported: February 08, 2019 </li> Advisory ID: WSA-2019-0001 </li> CVE identifiers: CVE-2019-6212</a>, CVE-2019-6215</a>, CVE-2019-6216</a>, CVE-2019-6217</a>, CVE-2019-6226</a>, CVE-2019-6227</a>, CVE-2019-6229</a>, CVE-2019-6233</a>, CVE-2019-6234</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. CVE-2019-6212</a> Versions affected: WebKitGTK+ before 2.22.6 and WPE WebKit before 2.22.4.</li> Credit to an anonymous researcher.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-6215</a> Versions affected: WebKitGTK+ before 2.22.6 and WPE WebKit before 2.22.4.</li> Credit to Lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2019-6216</a> Versions affected: WebKitGTK+ before 2.22.5 and WPE WebKit before 2.22.3.</li> Credit to Fluoroacetate working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-6217</a> Versions affected: WebKitGTK+ before 2.22.5 and WPE WebKit before 2.22.3.</li> Credit to Fluoroacetate working with Trend Micro's Zero Day Initiative, Proteas, Shrek_wzw, and Zhuo Liang of Qihoo 360 Nirvan Team.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-6226</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Apple.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2019-6227</a> Versions affected: WebKitGTK+ before 2.22.5 and WPE WebKit before 2.22.3.</li> Credit to Qixun Zhao of Qihoo 360 Vulcan Team.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2019-6229</a> Versions affected: WebKitGTK+ before 2.22.5 and WPE WebKit before 2.22.3.</li> Credit to Ryan Pickren.</li> Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.</li> </ul> </li> CVE-2019-6233</a> Versions affected: WebKitGTK+ before 2.22.4 and WPE WebKit before 2.22.2.</li> Credit to G. Geshev from MWR Labs working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2019-6234</a> Versions affected: WebKitGTK+ before 2.22.4 and WPE WebKit before 2.22.2.</li> Credit to G. Geshev from MWR Labs working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK+ 2.23.3 released! 2019-01-14T00:00:00+00:00 This is a development release leading toward 2.24 series. What's new in the WebKitGTK+ 2.23.3 release?</h3> Fix rendering of emoji sequences containing zero width joiner.</li> Fallback to a colored font when rendering emojis.</li> Fix rendering artifacts on Youtube while scrolling under X11.</li> Remove DConf permissions from sandbox.</li> Fix build from release tarball with gtkdoc enabled.</li> Fix several crashes and rendering issues.</li> Translation updates: Swedish</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.23.2 released! 2019-01-08T00:00:00+00:00 This is a development release leading toward 2.24 series. What's new in the WebKitGTK+ 2.23.2 release?</h3> Fix rendering artifacts in some websites with accelerated compositing enabled.</li> Add initial support for variation fonts.</li> Add new API to convert a URI to a format for display.</li> Make scrollbars follow gtk-primary-button-warps-slider setting.</li> Fix crashes when closing the WebDriver session.</li> Fix the build with OpenGL disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.22.5 released! 2018-12-13T00:00:00+00:00 This is a bug fix release in the stable 2.22 series. What's new in the WebKitGTK+ 2.22.5 release?</h3> Improved the logic to determine for which architectures to enable the JIT compiler support and USE_SYSTEM_MALLOC at build time.</li> Fix the build with ENABLE_VIDEO=OFF and ENABLE_OPENGL=OFF.</li> Fix several crashes.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0009 2018-12-13T00:00:00+00:00 Date Reported: December 13, 2018 </li> Advisory ID: WSA-2018-0009 </li> CVE identifiers: CVE-2018-4437</a>, CVE-2018-4438</a>, CVE-2018-4441</a>, CVE-2018-4442</a>, CVE-2018-4443</a>, CVE-2018-4464</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. CVE-2018-4437</a> Versions affected: WebKitGTK+ before 2.22.5 and WPE WebKit before 2.22.3.</li> Credit to HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4438</a> Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management.</li> </ul> </li> CVE-2018-4441</a> Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4442</a> Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4443</a> Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4464</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK+ 2.23.1 released! 2018-11-22T00:00:00+00:00 This is the first development release leading toward 2.24 series. What's new in the WebKitGTK+ 2.23.1 release?</h3> Add initial support for subprocess sandboxing in Linux.</li> Add new permission request type for media device information.</li> Make scrollbars follow gtk-primary-button-warps-slider setting.</li> Script dialogs are now modal to the current web view only.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.22.4 released! 2018-11-21T00:00:00+00:00 This is a bug fix release in the stable 2.22 series. What's new in the WebKitGTK+ 2.22.4 release?</h3> Expose ENABLE_MEDIA_SOURCE as a public build option.</li> Fix a crash when using Cairo versions between 1.15 and 1.16.0</li> Fix the build with -DLOG_DISABLED=0.</li> Fix the build with ENABLE_VIDEO=OFF and ENABLE_WEB_AUDIO=OFF.</li> Fix debug builds of JavaScriptCore.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0008 2018-11-21T00:00:00+00:00 Date Reported: November 21, 2018 </li> Advisory ID: WSA-2018-0008 </li> CVE identifiers: CVE-2018-4345</a>, CVE-2018-4372</a>, CVE-2018-4373</a>, CVE-2018-4375</a>, CVE-2018-4376</a>, CVE-2018-4378</a>, CVE-2018-4382</a>, CVE-2018-4386</a>, CVE-2018-4392</a>, CVE-2018-4416</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. CVE-2018-4345</a> Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1.</li> Credit to an anonymous researcher.</li> A cross-site scripting issue existed in WebKit. This issue was addressed with improved URL validation.</li> </ul> </li> CVE-2018-4372</a> Versions affected: WebKitGTK+ before 2.22.4 and WPE WebKit before 2.22.2.</li> Credit to HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4373</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to ngg, alippai, DirtYiCE, KT of Tresorit working with Trend Micro’s Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4375</a> Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before 2.22.0.</li> Credit to Yu Haiwan and Wu Hongjun From Nanyang Technological University working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4376</a> Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before 2.22.0.</li> Credit to 010 working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4378</a> Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before 2.22.0.</li> Credit to an anonymous researcher, zhunki of 360 ESG Codesafe Team.</li> Processing maliciously crafted web content may lead to code execution. A memory corruption issue was addressed with improved validation.</li> </ul> </li> CVE-2018-4382</a> Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before 2.22.0.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4386</a> Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4392</a> Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before 2.22.0.</li> Credit to zhunki of 360 ESG Codesafe Team.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4416</a> Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before 2.22.0.</li> Credit to lokihardt of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK+ 2.22.3 released! 2018-10-29T00:00:00+00:00 This is a bug fix release in the stable 2.22 series. What's new in the WebKitGTK+ 2.22.3 release?</h3> Many improvements and fixes for video playback with media source extensions (MSE), which improve the user experience across the board, and in particular for playback of WebM videos.</li> Fix a memory leak during media playback when using playbin3.</li> Fix portions of Web views not being rendered after resizing.</li> Fix Resource Timing reporting for elements.</li> Fix the build with the remote Web Inspector disabled.</li> Fix the build on ARMv7 with NEON extensions.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007 2018-09-26T00:00:00+00:00 Date Reported: September 26, 2018 </li> Advisory ID: WSA-2018-0007 </li> CVE identifiers: CVE-2018-4207</a>, CVE-2018-4208</a>, CVE-2018-4209</a>, CVE-2018-4210</a>, CVE-2018-4212</a>, CVE-2018-4213</a>, CVE-2018-4191</a>, CVE-2018-4197</a>, CVE-2018-4299</a>, CVE-2018-4306</a>, CVE-2018-4309</a>, CVE-2018-4311</a>, CVE-2018-4312</a>, CVE-2018-4314</a>, CVE-2018-4315</a>, CVE-2018-4316</a>, CVE-2018-4317</a>, CVE-2018-4318</a>, CVE-2018-4319</a>, CVE-2018-4323</a>, CVE-2018-4328</a>, CVE-2018-4358</a>, CVE-2018-4359</a>, CVE-2018-4361</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. CVE-2018-4207</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Google OSS-Fuzz.</li> Unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.</li> </ul> </li> CVE-2018-4208</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Google OSS-Fuzz.</li> Unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.</li> </ul> </li> CVE-2018-4209</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Google OSS-Fuzz.</li> Unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.</li> </ul> </li> CVE-2018-4210</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Google OSS-Fuzz.</li> Unexpected interaction with indexing types caused a failure. An array indexing issue existed in the handling of a function in JavaScriptCore. This issue was addressed with improved checks.</li> </ul> </li> CVE-2018-4212</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Google OSS-Fuzz.</li> Unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.</li> </ul> </li> CVE-2018-4213</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Google OSS-Fuzz.</li> Unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.</li> </ul> </li> CVE-2018-4191</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Google OSS-Fuzz.</li> Unexpected interaction causes an ASSERT failure. A memory corruption issue was addressed with improved validation.</li> </ul> </li> CVE-2018-4197</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2018-4299</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Samuel Groβ (saelo) working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4306</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2018-4309</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to an anonymous researcher working with Trend Micro's Zero Day Initiative.</li> A malicious website may be able to execute scripts in the context of another website. A cross-site scripting issue existed in WebKit. This issue was addressed with improved URL validation.</li> </ul> </li> CVE-2018-4311</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Erling Alf Ellingsen (@steike).</li> Cross-origin SecurityErrors includes the accessed frame’s origin. The issue was addressed by removing origin information.</li> </ul> </li> CVE-2018-4312</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2018-4314</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2018-4315</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2018-4316</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2018-4317</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2018-4318</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A use after free issue was addressed with improved memory management.</li> </ul> </li> CVE-2018-4319</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to John Pettitt of Google.</li> A malicious website may cause unexepected cross-origin behavior. A cross-origin issue existed with iframe elements. This was addressed with improved tracking of security origins.</li> </ul> </li> CVE-2018-4323</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4328</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4358</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4359</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Samuel Groß (@5aelo).</li> Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4361</a> Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.</li> Credit to Google OSS-Fuzz.</li> Unexpected interaction causes an ASSERT failure. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK+ 2.22.2 released! 2018-09-21T00:00:00+00:00 This is a bug fix release in the stable 2.22 series. What's new in the WebKitGTK+ 2.22.2 release?</h3> Several fixes for video playback with media source extensions (MSE). This allows using WebM support for YouTube, which no longer works through regular video source. Note that MSE is still disabled by default and webkit_settings_set_enable_mediasource() has to be used to enable the feature.</li> Fix the build when only Wayland support is enabled and X11 headers are not available.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.22.1 released! 2018-09-20T00:00:00+00:00 This is the first bug fix release in the stable 2.22 series. What's new in the WebKitGTK+ 2.22.1 release?</h3> Fix printing in landscape.</li> Fix the build in several platforms: s390x, ppc64le, armv7hl.</li> Fix the build with a11y disabled.</li> Fix the build with video disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.22.0 released! 2018-09-03T00:00:00+00:00 This is the first stable release in the 2.22 series. Highlights of the WebKitGTK+ 2.22.0 release</h3> New JavaScriptCore GLib API.</li> Switched to use complex text code path unconditionally.</li> Added playbin3 support to GStreamer media backend</li> Support for WebDriver advance user insteraction commands.</li> Default option menu implementation now uses a GtkTreeView.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.22 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK+ 2.21.92 released! 2018-08-24T00:00:00+00:00 This is a development release leading toward 2.22 series. What's new in the WebKitGTK+ 2.21.92 release?</h3> Add new API to inject/register user content in isolated worlds.</li> Add more API to JSCException to handle column number, convert exception to string, get the exception backtrace, create exceptions with a custom error name and report exception message with full details.</li> Fix excessive CPU usage when getting the process memory footprint.</li> Fix several crashes and rendering issues.</li> Translation updates: Polish</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.21.91 released! 2018-08-16T00:00:00+00:00 This is a development release leading toward 2.22 series. What's new in the WebKitGTK+ 2.21.91 release?</h3> Add enable-media-capabilities setting.</li> Stop pushing buffers when seeking status changes in media player.</li> Fix rendering of theme styled buttons.</li> Fix several crashes and rendering issues.</li> Translation updates: Brazilian Portuguese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.20.5 released! 2018-08-13T00:00:00+00:00 This is a bug fix release in the stable 2.20 series. What's new in the WebKitGTK+ 2.20.5 release?</h3> Fix rendering artifacts in some web sites due to a bug introduced in 2.20.4.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0006 2018-08-07T00:00:00+00:00 Date Reported: August 07, 2018 </li> Advisory ID: WSA-2018-0006 </li> CVE identifiers: CVE-2018-4246</a>, CVE-2018-4261</a>, CVE-2018-4262</a>, CVE-2018-4263</a>, CVE-2018-4264</a>, CVE-2018-4265</a>, CVE-2018-4266</a>, CVE-2018-4267</a>, CVE-2018-4270</a>, CVE-2018-4271</a>, CVE-2018-4272</a>, CVE-2018-4273</a>, CVE-2018-4278</a>, CVE-2018-4284</a>, CVE-2018-12911</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. CVE-2018-4246</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.1.</li> Credit to OSS-Fuzz.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4261</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to Omair working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4262</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to Mateusz Krzywicki working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4263</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to Arayz working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4264</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to OSS-Fuzz, Yu Zhou and Jundong Xie of Ant-financial Light- Year Security Lab.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4265</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to cc working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4266</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to OSS-Fuzz.</li> A malicious website may be able to cause a denial of service. A race condition was addressed with additional validation.</li> </ul> </li> CVE-2018-4267</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to Arayz of Pangu team working with Trend Micro's Zero Day Initiative.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4270</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to OSS-Fuzz.</li> Processing maliciously crafted web content may lead to an unexpected application crash. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4271</a> Versions affected: WebKitGTK+ before 2.20.2.</li> Credit to OSS-Fuzz.</li> Processing maliciously crafted web content may lead to an unexpected application crash. A memory corruption issue was addressed with improved input validation.</li> </ul> </li> CVE-2018-4272</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to OSS-Fuzz.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4273</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to OSS-Fuzz.</li> Processing maliciously crafted web content may lead to an unexpected application crash. A memory corruption issue was addressed with improved input validation.</li> </ul> </li> CVE-2018-4278</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to Jun Kokatsu (@shhnjk).</li> A malicious website may exfiltrate audio data cross-origin. Sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.</li> </ul> </li> CVE-2018-4284</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to OSS-Fuzz.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-12911</a> Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.</li> Credit to Yu Haiwan.</li> Processing maliciously crafted web content may lead to arbitrary code execution. A buffer overflow issue was addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK+ 2.20.4 released! 2018-08-06T00:00:00+00:00 This is a bug fix release in the stable 2.20 series. What's new in the WebKitGTK+ 2.20.4 release?</h3> Fix a crash when leaving accelerated compositing mode.</li> Fix non-deterministic build failure due to missing JavaScriptCore/JSContextRef.h.</li> Security fixes: CVE-2018-4261</a>, CVE-2018-4262</a>, CVE-2018-4263</a>, CVE-2018-4264</a>, CVE-2018-4265</a>, CVE-2018-4266</a>, CVE-2018-4267</a>, CVE-2018-4270</a>, CVE-2018-4272</a>, CVE-2018-4273</a>, CVE-2018-4278</a>, CVE-2018-4284</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.21.5 released! 2018-07-20T00:00:00+00:00 This is a development release leading toward 2.22 series. What's new in the WebKitGTK+ 2.21.5 release?</h3> Add API to evaluate code in a new object to JavaScriptCore GLib API.</li> Add API to check for syntax errors in given code to JavaScriptCore GLib API.</li> Update jsc_context_evaluate_with_source_uri() to receive also a starting line number.</li> Add API to allow creating variadic functions to JavaScriptCore GLib API.</li> Add --host option to WebDriver process.</li> Handle acceptInsecureCertificates capability in WebDriver.</li> Fix video freezes when GStreamerGL is not installed.</li> Fix several crashes and rendering issues.</li> Translation updates: Ukrainian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0005 2018-06-13T00:00:00+00:00 Date Reported: June 13, 2018 </li> Advisory ID: WSA-2018-0005 </li> CVE identifiers: CVE-2018-4190</a>, CVE-2018-4192</a>, CVE-2018-4199</a>, CVE-2018-4201</a>, CVE-2018-4214</a>, CVE-2018-4218</a>, CVE-2018-4222</a>, CVE-2018-4232</a>, CVE-2018-4233</a>, CVE-2018-11646</a>, CVE-2018-11712</a>, CVE-2018-11713</a>, CVE-2018-12293</a>, CVE-2018-12294</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. CVE-2018-4190</a> Versions affected: WebKitGTK+ before 2.20.3 and WPE WebKit before 2.20.1.</li> Credit to Jun Kokatsu (@shhnjk).</li> Impact: Visiting a maliciously crafted website may leak sensitive data. Description: Credentials were unexpectedly sent when fetching CSS mask images. This was addressed by using a CORS-enabled fetch method.</li> </ul> </li> CVE-2018-4192</a> Versions affected: WebKitGTK+ before 2.20.1.</li> Credit to Markus Gaasedelen, Nick Burnett, and Patrick Biernat of Ret2 Systems, Inc working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A race condition was addressed with improved locking.</li> </ul> </li> CVE-2018-4199</a> Versions affected: WebKitGTK+ before 2.20.3 and WPE WebKit before 2.20.1.</li> Credit to Alex Plaskett, Georgi Geshev, Fabi Beterke, and Nils of MWR Labs working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A buffer overflow issue was addressed with improved memory handling.</li> </ul> </li> CVE-2018-4201</a> Versions affected: WebKitGTK+ before 2.20.1.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4214</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to OSS-Fuzz.</li> Impact: Processing maliciously crafted web content may lead to an unexpected application crash. Description: A memory corruption issue was addressed with improved input validation.</li> </ul> </li> CVE-2018-4218</a> Versions affected: WebKitGTK+ before 2.20.3 and WPE WebKit before 2.20.1.</li> Credit to Natalie Silvanovich of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4222</a> Versions affected: WebKitGTK+ before 2.20.3 and WPE WebKit before 2.20.1.</li> Credit to Natalie Silvanovich of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An out-of-bounds read was addressed with improved input validation.</li> </ul> </li> CVE-2018-4232</a> Versions affected: WebKitGTK+ before 2.20.3 and WPE WebKit before 2.20.1.</li> Credit to Aymeric Chaib.</li> Impact: Visiting a maliciously crafted website may lead to cookies being overwritten. Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed with improved restrictions.</li> </ul> </li> CVE-2018-4233</a> Versions affected: WebKitGTK+ before 2.20.3 and WPE WebKit before 2.20.1.</li> Credit to Samuel Groß (@5aelo) working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-11646</a> Versions affected: WebKitGTK+ before 2.20.3 and WPE WebKit before 2.20.1.</li> Credit to Mishra Dhiraj.</li> Maliciously crafted web content could trigger an application crash in WebKitFaviconDatabase, caused by mishandling unexpected input.</li> </ul> </li> CVE-2018-11712</a> Versions affected: WebKitGTK+ 2.20.0 and 2.20.1.</li> Credit to Metrological Group B.V.</li> The libsoup network backend of WebKit failed to perform TLS certificate verification for WebSocket connections.</li> </ul> </li> CVE-2018-11713</a> Versions affected: WebKitGTK+ before 2.20.0 or without libsoup 2.62.0.</li> Credit to Dirkjan Ochtman.</li> The libsoup network backend of WebKit unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.</li> </ul> </li> CVE-2018-12293</a> Versions affected: WebKitGTK+ before 2.20.3 and WPE WebKit before 2.20.1.</li> Credit to ADlab of Venustech.</li> Maliciously crafted web content could achieve a heap buffer overflow in ImageBufferCairo by exploiting multiple integer overflow issues.</li> </ul> </li> CVE-2018-12294</a> Versions affected: WebKitGTK+ before 2.20.2.</li> Credit to ADlab of Venustech.</li> Maliciously crafted web content could trigger a use-after-free of a TextureMapperLayer object.</li> </ul> </li> </ul> We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running a safe version of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at https://webkitgtk.org/security.html</a> or https://wpewebkit.org/security/</a>. WebKitGTK+ 2.21.4 released! 2018-06-12T00:00:00+00:00 This is a development release leading toward 2.22 series. What's new in the WebKitGTK+ 2.21.4 release?</h3> Switch to use a popup window with a tree view instead of a menu for option menu default implementation.</li> Add API to run javascript from a WebKitWebView in an isolated world.</li> Fix UI process crash in WebKitFaviconDatabase when pageURL is unset.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.20.3 released! 2018-06-11T00:00:00+00:00 This is a bug fix release in the stable 2.20 series. What's new in the WebKitGTK+ 2.20.3 release?</h3> Fix installation directory of API documentation.</li> Disable Gigacage if mmap fails to allocate in Linux.</li> Add user agent quirk for paypal website.</li> Properly detect compiler flags, needed libs, and fallbacks for usage of 64-bit atomic operations.</li> Fix a network process crash when trying to get cookies of about:blank page.</li> Fix UI process crash when closing the window under Wayland.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2018-4190</a>, CVE-2018-4199</a>, CVE-2018-4218</a>, CVE-2018-4222</a>, CVE-2018-4232</a>, CVE-2018-4233</a>, CVE-2018-4246</a>, CVE-2018-11646</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.21.3 released! 2018-05-28T00:00:00+00:00 This is a development release leading toward 2.22 series. What's new in the WebKitGTK+ 2.21.3 release?</h3> Ensure memory monitor properly notifies all child processes.</li> Add maximize, minimize and fullscreen window commands to WebDriver.</li> Fix a network process crash when trying to get cookies of about:blank page.</li> Fix UI process crash when closing the window under Wayland.</li> Disable Gigacage if mmap fails to allocate in Linux.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.21.2 released! 2018-05-21T00:00:00+00:00 This is a development release leading toward 2.22 series. What's new in the WebKitGTK+ 2.21.2 release?</h3> Remove resource load statistics API, it's not ready yet.</li> Add initial implementation of WebDriver advance user insteraction commands.</li> Add introspectable alternatives for functions using vargars to JavaScriptCore GLib API.</li> Implement MouseEvent.buttons.</li> Do TLS error checking on GTlsConnection::accept-certificate to finish the load earlier in case of errors.</li> Fix downloads started by context menu failing in some websites due to missing user agent HTTP header.</li> Avoid painting backing stores for zero-opacity layers.</li> Fix the installation path of API documentation.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.20.2 released! 2018-05-07T00:00:00+00:00 This is a bug fix release in the stable 2.20 series. What's new in the WebKitGTK+ 2.20.2 release?</h3> Do TLS error checking on GTlsConnection::accept-certificate to finish the load earlier in case of errors.</li> Properly close the connection to the nested wayland compositor in the Web Process.</li> Avoid painting backing stores for zero-opacity layers.</li> Fix downloads started by context menu failing in some websites due to missing user agent HTTP header.</li> Fix video unpause when GStreamerGL is disabled.</li> Fix several GObject introspection annotations.</li> Update user agent quiks to fix Outlook.com and Chase.com.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2018-4200</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2018-0004 2018-05-07T00:00:00+00:00 Date Reported: May 07, 2018 </li> Advisory ID: WSA-2018-0004 </li> CVE identifiers: CVE-2018-4121</a>, CVE-2018-4200</a>, CVE-2018-4204</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2018-4121</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Natalie Silvanovich of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4200</a> Versions affected: WebKitGTK+ before 2.20.2.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management.</li> </ul> </li> CVE-2018-4204</a> Versions affected: WebKitGTK+ before 2.20.1.</li> Credit to Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative, found by OSS-Fuzz.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.21.1 released! 2018-04-18T00:00:00+00:00 This is the first development release leading toward 2.22 series. What's new in the WebKitGTK+ 2.21.1 release?</h3> Add initial JavaScriptCore GLib API.</li> Use JavaScriptCore GLib API in WebKit layer and deprecate most of the DOM bindings API as well as methods using the JavaScriptCore C API.</li> Switch to use complex text code path unconditionally.</li> Properly close the connection to the Wayland nested compositor in the WebProcess.</li> Implement support for Graphics ARIA roles.</li> Add playbin3 support to GStreamer media backend.</li> Fix a deadlock when destroying the media player in non accelerated compositing mode.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.20.1 released! 2018-04-10T00:00:00+00:00 This is the first bug fix release in the stable 2.20 series. What's new in the WebKitGTK+ 2.20.1 release?</h3> Improve error message when Gigacage cannot allocate virtual memory.</li> Add missing WebKitWebProcessEnumTypes.h to webkit-web-extension.h.</li> Improve web process memory monitor thresholds.</li> Fix a web process crash when the web view is created and destroyed quickly.</li> Fix a network process crash when load is cancelled while searching for stored HTTP auth credentials.</li> Fix the build when ENABLE_VIDEO, ENABLE_WEB_AUDIO and ENABLE_XSLT are disabled.</li> Fix several crashes and rendering issues.</li> Translation updates: Brazilian Portuguese, Czech.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2018-0003 2018-04-04T00:00:00+00:00 Date Reported: April 04, 2018 </li> Advisory ID: WSA-2018-0003 </li> CVE identifiers: CVE-2018-4101</a>, CVE-2018-4113</a>, CVE-2018-4114</a>, CVE-2018-4117</a>, CVE-2018-4118</a>, CVE-2018-4119</a>, CVE-2018-4120</a>, CVE-2018-4122</a>, CVE-2018-4125</a>, CVE-2018-4127</a>, CVE-2018-4128</a>, CVE-2018-4129</a>, CVE-2018-4133</a>, CVE-2018-4146</a>, CVE-2018-4161</a>, CVE-2018-4162</a>, CVE-2018-4163</a>, CVE-2018-4165</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2018-4101</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Yuan Deng of Ant-financial Light-Year Security Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4113</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to OSS-Fuzz.</li> Impact: Unexpected interaction with indexing types causing an ASSERT failure. Description: An array indexing issue existed in the handling of a function in JavaScriptCore. This issue was addressed through improved checks.</li> </ul> </li> CVE-2018-4114</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to OSS-Fuzz.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4117</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to an anonymous researcher.</li> Impact: A malicious website may exfiltrate data cross-origin. Description: A cross-origin issue existed with the fetch API. This was addressed through improved input validation.</li> </ul> </li> CVE-2018-4118</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Jun Kokatsu (@shhnjk).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4119</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to an anonymous researcher working with Trend Micro’s Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4120</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4122</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to WanderingGlitch of Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4125</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to WanderingGlitch of Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4127</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to an anonymous researcher working with Trend Micro’s Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4128</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Zach Markley.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4129</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to likemeng of Baidu Security Lab working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4133</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Anton Lopanitsyn of Wallarm, Linus Särud of Detectify (detectify.com), Yuji Tounai of NTT Communications Corporation.</li> Impact: Visiting a maliciously crafted website may lead to a cross- site scripting attack. Description: A cross-site scripting issue existed in WebKit. This issue was addressed with improved URL validation.</li> </ul> </li> CVE-2018-4146</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to OSS-Fuzz.</li> Impact: Processing maliciously crafted web content may lead to a denial of service. Description: A memory corruption issue was addressed through improved input validation.</li> </ul> </li> CVE-2018-4161</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to WanderingGlitch of Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4162</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to WanderingGlitch of Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4163</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to WanderingGlitch of Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4165</a> Versions affected: WebKitGTK+ before 2.20.0.</li> Credit to Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.20.0 released! 2018-03-12T00:00:00+00:00 This is the first stable release in the 2.20 series. Highlights of the WebKitGTK+ 2.20.0 release</h3> New API to retrieve and delete cookies with WebKitCookieManager.</li> New web process API to detect when form is submitted via JavaScript.</li> Several improvements and fixes in the touch/gestures support.</li> Support for the "system" CSS font family.</li> Complex text rendering improvements and fixes.</li> Added a low power mode.</li> More complete and spec compliant WebDriver implementation.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.20 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK+ 2.19.92 released! 2018-03-06T00:00:00+00:00 This is a development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.92 release?</h3> Ensure DNS prefetching cannot be re-enabled if disabled by settings.</li> Fix seek sometimes not working.</li> Fix rendering of emojis that were using the wrong scale factor in some cases.</li> Fix rendering of combining enclosed keycap.</li> Fix rendering scale of some layers in HiDPI.</li> Fix a crash in Wayland when closing the web view.</li> Fix crashes upower crashes when running inside a chroot or on systems with broken dbus/upower.</li> Fix memory leaks in GStreamer media backend when using GStreamer 1.14.</li> Fix the build with Enchant 2.x.</li> Fix several crashes and rendering issues.</li> Translation updates: Indonesian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.19.91 released! 2018-02-21T00:00:00+00:00 This is a development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.91 release?</h3> Add ENABLE_ADDRESS_SANITIZER to make it easier to build with asan support.</li> Fix a crash a under Wayland when using mesa software rasterization.</li> Make fullscreen video work again.</li> Fix handling of missing GStreamer elements.</li> Fix rendering when webm video is played twice.</li> Fix kinetic scrolling sometimes jumping around.</li> Fix build with ICU configured without collation support.</li> Fix several crashes and rendering issues.</li> Translation updates: Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.19.90 released! 2018-02-05T00:00:00+00:00 This is a development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.90 release?</h3> WebSockets use system proxy settings now (requires libsoup 2.61.90).</li> Show the context menu on long-press gesture.</li> Add support for Shift + mouse scroll to scroll horizontally.</li> Fix zoom gesture to actually zoom instead of changing the page scale.</li> Implement support for Graphics ARIA roles.</li> Make sleep inhibitors work under Flatpak.</li> Add get element CSS value command to WebDriver.</li> Fix a crash aftter a swipe gesture.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.18.6 released! 2018-01-24T00:00:00+00:00 This is a bug fix release in the stable 2.18 series. What's new in the WebKitGTK+ 2.18.6 release?</h3> Fix deadlock in GStreamer video sink during shutdown when accelerated compositing is disabled.</li> Several fixes and improvements in WebDriver.</li> Security fixes: CVE-2018-4088</a>, CVE-2017-13885</a>, CVE-2017-7165</a>, CVE-2017-13884</a>, CVE-2017-7160</a>, CVE-2017-7153</a>, CVE-2017-7153</a>, CVE-2017-7161</a>, CVE-2018-4096</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2018-0002 2018-01-24T00:00:00+00:00 Date Reported: January 24, 2018 </li> Advisory ID: WSA-2018-0002 </li> CVE identifiers: CVE-2018-4088</a>, CVE-2018-4089</a>, CVE-2018-4096</a>, CVE-2017-7153</a>, CVE-2017-7160</a>, CVE-2017-7161</a>, CVE-2017-7165</a>, CVE-2017-13884</a>, CVE-2017-13885</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2018-4088</a> Versions affected: WebKitGTK+ before 2.18.6.</li> Credit to Jeonghoon Shin of Theori.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4089</a> Versions affected: WebKitGTK+ before 2.18.4.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2018-4096</a> Versions affected: WebKitGTK+ before 2.18.6.</li> Credit to OSS-Fuzz.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7153</a> Versions affected: WebKitGTK+ before 2.18.6.</li> Credit to Jerry Decime.</li> Impact: Visiting a malicious website may lead to user interface spoofing. Description: Redirect responses to 401 Unauthorized may allow a malicious website to incorrectly display the lock icon on mixed content. This issue was addressed through improved URL display logic.</li> </ul> </li> CVE-2017-7160</a> Versions affected: WebKitGTK+ before 2.18.6.</li> Credit to Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7161</a> Versions affected: WebKitGTK+ before 2.18.6.</li> Credit to Mitin Svyat.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A command injection issue existed in Web Inspector. This issue was addressed through improved escaping of special characters.</li> </ul> </li> CVE-2017-7165</a> Versions affected: WebKitGTK+ before 2.18.6.</li> Credit to 360 Security working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13884</a> Versions affected: WebKitGTK+ before 2.18.6.</li> Credit to 360 Security working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13885</a> Versions affected: WebKitGTK+ before 2.18.6.</li> Credit to 360 Security working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.19.6 released! 2018-01-17T00:00:00+00:00 This is a development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.6 release?</h3> Fix crashes due to duplicated symbols in libjavascriptcoregtk and libwebkit2gtk.</li> Fix parsing of timeout values in WebDriver.</li> Implement get timeouts command in WebDriver.</li> Fix deadlock in GStreamer video sink during shutdown when accelerated compositing is disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.18.5 released! 2018-01-10T00:00:00+00:00 This is a bug fix release in the stable 2.18 series. What's new in the WebKitGTK+ 2.18.5 release?</h3> Disable SharedArrayBuffers from Web API.</li> Reduce the precision of "high" resolution time to 1ms.</li> Fix API documentation generation with newer gtk-doc.</li> Security fixes: includes improvements to mitigate the effects of Spectre (CVE-2017-5753</a> and CVE-2017-5715</a>).</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2018-0001 2018-01-10T00:00:00+00:00 Date Reported: January 10, 2018 </li> Advisory ID: WSA-2018-0001 </li> CVE identifiers: CVE-2017-5753</a>, CVE-2017-5715</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-5753</a> Versions affected: WebKitGTK+ before 2.18.5.</li> Credit to Jann Horn of Google Project Zero; and Paul Kocher in collaboration with Daniel Genkin of University of Pennsylvania and University of Maryland, Daniel Gruss of Graz University of Technology, Werner Haas of Cyberus Technology, Mike Hamburg of Rambus (Cryptography Research Division), Moritz Lipp of Graz University of Technology, Stefan Mangard of Graz University of Technology, Thomas Prescher of Cyberus Technology, Michael Schwarz of Graz University of Technology, and Yuval Yarom of University of Adelaide and Data61.</li> Impact: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker via a side-channel analysis. This variant of the Spectre vulnerability triggers the speculative execution by performing a bounds-check bypass. Description: Security improvements are included to mitigate the effects.</li> </ul> </li> CVE-2017-5715</a> Versions affected: WebKitGTK+ before 2.18.5.</li> Credit to Jann Horn of Google Project Zero; and Paul Kocher in collaboration with Daniel Genkin of University of Pennsylvania and University of Maryland, Daniel Gruss of Graz University of Technology, Werner Haas of Cyberus Technology, Mike Hamburg of Rambus (Cryptography Research Division), Moritz Lipp of Graz University of Technology, Stefan Mangard of Graz University of Technology, Thomas Prescher of Cyberus Technology, Michael Schwarz of Graz University of Technology, and Yuval Yarom of University of Adelaide and Data61.</li> Impact: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker via a side-channel analysis. This variant of the Spectre vulnerability triggers the speculative execution by utilizing branch target injection. Description: Security improvements are included to mitigate the effects.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.19.4 released! 2018-01-09T00:00:00+00:00 This is a development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.4 release?</h3> Add web process API to detect when form is submitted via JavaScript.</li> Add new API to replace webkit_form_submission_request_get_text_fields() that is now deprecated.</li> Add WebKitWebView::web-process-terminated signal and deprecate web-process-crashed.</li> Fix rendering issues when editing text areas.</li> Use FastMalloc based GstAllocator for GStreamer.</li> Fix several crashes and rendering issues.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.19.5 released! 2018-01-09T00:00:00+00:00 This is a development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.5 release?</h3> This is a follow up release to export webkit_dom_dom_window_webkit_message_handlers_post_message() symbol that was hidden in 2.19.4 by mistake.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.18.4 released! 2017-12-19T00:00:00+00:00 This is a bug fix release in the stable 2.18 series. What's new in the WebKitGTK+ 2.18.4 release?</h3> Make WebDriver implementation more spec compliant.</li> Fix a bug when trying to remove cookies before a web process is spawned.</li> WebKitWebDriver process no longer links to libjavascriptcoregtk.</li> Fix several memory leaks in GStreamer media backend.</li> Security fixes: CVE-2017-13866</a>, CVE-2017-13870</a>, CVE-2017-7156</a>, CVE-2017-13856</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0010 2017-12-19T00:00:00+00:00 Date Reported: December 19, 2017 </li> Advisory ID: WSA-2017-0010 </li> CVE identifiers: CVE-2017-7156</a>, CVE-2017-7157</a>, CVE-2017-13856</a>, CVE-2017-13866</a>, CVE-2017-13870</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-7156</a> Versions affected: WebKitGTK+ before 2.18.4.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7157</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13856</a> Versions affected: WebKitGTK+ before 2.18.4.</li> Credit to Jeonghoon Shin.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13866</a> Versions affected: WebKitGTK+ before 2.18.4.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13870</a> Versions affected: WebKitGTK+ before 2.18.4.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.19.3 released! 2017-12-13T00:00:00+00:00 This is a development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.3 release?</h3> Fix web process crash at startup in bmalloc.</li> Fix several memory leaks in GStreamer media backend.</li> WebKitWebDriver process no longer links to libjavascriptcoregtk.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.19.2 released! 2017-11-21T00:00:00+00:00 This is a development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.2 release?</h3> Add new API to add, retrieve and delete cookies via WebKitCookieManager.</li> Add functions to WebSettings to convert font sizes between points and pixels.</li> Ensure cookie operations take effect when they happen before a web process has been spawned.</li> Automatically adjust font size when GtkSettings:gtk-xft-dpi changes.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.18.3 released! 2017-11-10T00:00:00+00:00 This is a bug fix release in the stable 2.18 series. What's new in the WebKitGTK+ 2.18.3 release?</h3> Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases.</li> Fix handling of null capabilities in WebDriver implementation.</li> Security fixes: CVE-2017-13798</a>, CVE-2017-13788</a>, CVE-2017-13803</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0009 2017-11-10T00:00:00+00:00 Date Reported: November 10, 2017 </li> Advisory ID: WSA-2017-0009 </li> CVE identifiers: CVE-2017-13783</a>, CVE-2017-13784</a>, CVE-2017-13785</a>, CVE-2017-13788</a>, CVE-2017-13791</a>, CVE-2017-13792</a>, CVE-2017-13793</a>, CVE-2017-13794</a>, CVE-2017-13795</a>, CVE-2017-13796</a>, CVE-2017-13798</a>, CVE-2017-13802</a>, CVE-2017-13803</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-13783</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13784</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13785</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13788</a> Versions affected: WebKitGTK+ before 2.18.3.</li> Credit to xisigr of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13791</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13792</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13793</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Hanul Choi working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13794</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13795</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13796</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13798</a> Versions affected: WebKitGTK+ before 2.18.3.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13802</a> Versions affected: WebKitGTK+ before 2.18.1.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-13803</a> Versions affected: WebKitGTK+ before 2.18.3.</li> Credit to chenqin (陈钦) of Ant-financial Light-Year Security.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.19.1 released! 2017-10-31T00:00:00+00:00 This is the first development release leading toward 2.20 series. What's new in the WebKitGTK+ 2.19.1 release?</h3> Add initial resource load statistics support.</li> Add API to expose availability of certain editing commands in WebKitEditorState.</li> Add API to query whether a WebKitNavigationAction is a redirect or not.</li> Improve complex text rendering.</li> Add support for the "system" CSS font family.</li> Implement low power mode.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.18.2 released! 2017-10-27T00:00:00+00:00 This is a bug fix release in the stable 2.18 series. What's new in the WebKitGTK+ 2.18.2 release?</h3> Fix rendering of arabic text.</li> Fix a crash in the web process when decoding GIF images.</li> Fix rendering of wind in Windy.com.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.18.1 released! 2017-10-18T00:00:00+00:00 This is the first bug fix release in the stable 2.18 series. What's new in the WebKitGTK+ 2.18.1 release?</h3> Improve performance of GIF animations.</li> Fix garbled display in GMail.</li> Fix rendering of several material design icons when using the web font.</li> Fix flickering when resizing the window in Wayland.</li> Prevent default kerberos authentication credentials from being used in ephemeral sessions.</li> Fix a crash when webkit_web_resource_get_data() is cancelled.</li> Correctly handle touchmove and touchend events in WebKitWebView.</li> Fix the build with enchant 2.1.1.</li> Fix the build in HPPA and Alpha.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0008 2017-10-18T00:00:00+00:00 Date Reported: October 18, 2017 </li> Advisory ID: WSA-2017-0008 </li> CVE identifiers: CVE-2017-7081</a>, CVE-2017-7087</a>, CVE-2017-7089</a>, CVE-2017-7090</a>, CVE-2017-7091</a>, CVE-2017-7092</a>, CVE-2017-7093</a>, CVE-2017-7094</a>, CVE-2017-7095</a>, CVE-2017-7096</a>, CVE-2017-7098</a>, CVE-2017-7099</a>, CVE-2017-7100</a>, CVE-2017-7102</a>, CVE-2017-7104</a>, CVE-2017-7107</a>, CVE-2017-7109</a>, CVE-2017-7111</a>, CVE-2017-7117</a>, CVE-2017-7120</a>, CVE-2017-7142</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-7081</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed through improved input validation.</li> </ul> </li> CVE-2017-7087</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7089</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Anton Lopanitsyn of ONSEC, Frans Rosén of Detectify.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Description: A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management.</li> </ul> </li> CVE-2017-7090</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Apple.</li> Impact: Cookies belonging to one origin may be sent to another origin. Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed by no longer returning cookies for custom URL schemes.</li> </ul> </li> CVE-2017-7091</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Wei Yuan of Baidu Security Lab working with Trend Micro’s Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7092</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Qixun Zhao (@S0rryMybad) of Qihoo 360 Vulcan Team, Samuel Gro and Niklas Baumstark working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7093</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Samuel Gro and Niklas Baumstark working with Trend Micro’s Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7094</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to Tim Michaud (@TimGMichaud) of Leviathan Security Group.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7095</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University working with Trend Micro’s Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7096</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Wei Yuan of Baidu Security Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7098</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Felipe Freitas of Instituto Tecnológico de Aeronáutica.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7099</a> Versions affected: WebKitGTK+ before 2.16.4.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7100</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Masato Kinugawa and Mario Heiderich of Cure53.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7102</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7104</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to likemeng of Baidu Secutity Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7107</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7109</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to avlidienbrunn.</li> Impact: Processing maliciously crafted web content may lead to a cross site scripting attack. Description: Application Cache policy may be unexpectedly applied.</li> </ul> </li> CVE-2017-7111</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to likemeng of Baidu Security Lab (xlab.baidu.com) working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7117</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7120</a> Versions affected: WebKitGTK+ before 2.18.0.</li> Credit to chenqin (陈钦) of Ant-financial Light-Year Security Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7142</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to an anonymous researcher.</li> Impact: Website data may persist after a Safari Private browsing session. Description: An information leakage issue existed in the handling of website data in Safari Private windows. This issue was addressed with improved data handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.18.0 released! 2017-09-11T00:00:00+00:00 This is the first stable release in the 2.18 series. Highlights of the WebKitGTK+ 2.18.0 release</h3> Initial WebDriver support</a>.</li> New remote inspector infrastructure</a>.</li> WebCrypto API support is now enabled by default.</li> GStreamerGL is enabled by default when building with GStreamer >= 1.10.</li> Kinetic scrolling support.</li> New API to create a WebKitContextMenuItem from a GAction.</li> New API to allow overriding the popup menu of select elements.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.18 see the NEWS file that is included in the tarball. Thanks to all the contributors who made possible this release. WebKitGTK+ 2.17.92 released! 2017-09-04T00:00:00+00:00 This is a development release leading toward 2.18 series. What's new in the WebKitGTK+ 2.17.92 release?</h3> Improve CPU usage when rendering under Wayland in accelerated compositing mode.</li> Improve the memory consumption of the UI process under Wayland.</li> Fix rendering issues in some web sites with accelerated compositing enabled.</li> Fix a web process crash when closing the WebView.</li> Initialize libgcrypt in the network process too.</li> Show controls if a video element isn't allowed to play inline.</li> Add support for cookies and screenshots commands in WebDriver.</li> Fix several crashes and rendering issues.</li> Translation updates: Brazilian Portuguese, Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0007 2017-08-25T00:00:00+00:00 Date Reported: August 25, 2017 </li> Advisory ID: WSA-2017-0007 </li> CVE identifiers: CVE-2017-1000121</a>, CVE-2017-1000122</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-1000121</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to Nathan Crandall.</li> Impact: Processing maliciously crafted input may lead to arbitrary code execution or application crash. Description: An input validation issue on the handling of UNIX IPC messages may allow an attacker to trigger an integer overflow. The issue was addressed through improved state management.</li> </ul> </li> CVE-2017-1000122</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to Nathan Crandall.</li> Impact: Processing maliciously crafted input may lead to application crash. Description: An input validation issue on the handling of UNIX IPC messages allows an attacker to trigger an application crash. The issue was addressed through improved state management.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.17.91 released! 2017-08-18T00:00:00+00:00 This is a development release leading toward 2.18 series. What's new in the WebKitGTK+ 2.17.91 release?</h3> Fix proxy HTTP authentication for HTTPS requests.</li> Stop kinetic scrolling when a zero movement is reached.</li> Fix UI process crash when selecting text.</li> Fix UI process crash when loading a favicon.</li> Properly handle WebDriver click command on option elements.</li> Fix web process crash when resizing the window with accelerated compositing enabled.</li> Fix crashes in 32 bit systems due to incorrect use of GVariant.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.17.90 released! 2017-08-09T00:00:00+00:00 This is a development release leading toward 2.18 series. What's new in the WebKitGTK+ 2.17.90 release?</h3> WebCrypto API support is now enabled by default.</li> Add API to provide browser information required by automation.</li> Fix the expiration date of manually added cookies.</li> Add support for alerts in WebDriver.</li> WebKitDatabaseProcess binary has been renamed to WebKitStorageProcess.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.17.5 released! 2017-07-26T00:00:00+00:00 This is a development release leading toward 2.18 series. What's new in the WebKitGTK+ 2.17.5 release?</h3> Add initial implementation of WebDriver.</li> Enable GStreamerGL by default when building with GStreamer >= 1.10.</li> Fix position of context menu in Wayland.</li> Properly close cookies database at network process exit.</li> Fix several crashes and rendering issues.</li> Translation updates: Ukrainian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0006 2017-07-25T00:00:00+00:00 Date Reported: July 25, 2017 </li> Advisory ID: WSA-2017-0006 </li> CVE identifiers: CVE-2017-7006</a>, CVE-2017-7011</a>, CVE-2017-7012</a>, CVE-2017-7018</a>, CVE-2017-7019</a>, CVE-2017-7020</a>, CVE-2017-7030</a>, CVE-2017-7034</a>, CVE-2017-7037</a>, CVE-2017-7038</a>, CVE-2017-7039</a>, CVE-2017-7040</a>, CVE-2017-7041</a>, CVE-2017-7042</a>, CVE-2017-7043</a>, CVE-2017-7046</a>, CVE-2017-7048</a>, CVE-2017-7049</a>, CVE-2017-7052</a>, CVE-2017-7055</a>, CVE-2017-7056</a>, CVE-2017-7059</a>, CVE-2017-7061</a>, CVE-2017-7064</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-7006</a> Versions affected: WebKitGTK+ before 2.16.2.</li> Credit to David Kohlbrenner of UC San Diego, an anonymous researcher.</li> Impact: A malicious website may exfiltrate data cross-origin. Description: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.</li> </ul> </li> CVE-2017-7011</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to xisigr of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Visiting a malicious website may lead to address bar spoofing. Description: A state management issue was addressed with improved frame handling.</li> </ul> </li> CVE-2017-7012</a> Versions affected: WebKitGTK+ before 2.16.2.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7018</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7019</a> Versions affected: WebKitGTK+ before 2.16.2.</li> Credit to Zhiyang Zeng of Tencent Security Platform Department.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7020</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to likemeng of Baidu Security Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7030</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to chenqin of Ant-financial Light-Year Security Lab (蚂蚁金服巴斯光年安全实验室).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7034</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to chenqin of Ant-financial Light-Year Security Lab (蚂蚁金服巴斯光年安全实验室).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7037</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7038</a> Versions affected: WebKitGTK+ before 2.16.2.</li> Credit to Neil Jenkins of FastMail Pty Ltd, Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security.</li> Impact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting. Description: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.</li> </ul> </li> CVE-2017-7039</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7040</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7041</a> Versions affected: WebKitGTK+ before 2.16.2.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7042</a> Versions affected: WebKitGTK+ before 2.16.2.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7043</a> Versions affected: WebKitGTK+ before 2.16.2.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7046</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7048</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7049</a> Versions affected: WebKitGTK+ before 2.16.2.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> CVE-2017-7052</a> Versions affected: WebKitGTK+ before 2.16.4.</li> Credit to cc working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7055</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to The UK's National Cyber Security Centre (NCSC).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7056</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7059</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to an anonymous researcher.</li> Impact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting. Description: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.</li> </ul> </li> CVE-2017-7061</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-7064</a> Versions affected: WebKitGTK+ before 2.16.6.</li> Credit to lokihardt of Google Project Zero.</li> Impact: An application may be able to read restricted memory. Description: A memory initialization issue was addressed through improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.16.6 released! 2017-07-24T00:00:00+00:00 This is a bug fix release in the stable 2.16 series. What's new in the WebKitGTK+ 2.16.6 release?</h3> Fix rendering of spin buttons with GTK+ >= 3.20 when the entry width is too short.</li> Fix the build when Wayland target is enabled and X11 disabled.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2017-7039</a>, CVE-2017-7018</a>, CVE-2017-7030</a>, CVE-2017-7037</a>, CVE-2017-7034</a>, CVE-2017-7055</a>, CVE-2017-7056</a>, CVE-2017-7064</a>, CVE-2017-7061</a>, CVE-2017-7048</a>, CVE-2017-7046</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.16.5 released! 2017-06-27T00:00:00+00:00 This is a bug fix release in the stable 2.16 series. What's new in the WebKitGTK+ 2.16.5 release?</h3> Fix a web process crash when page finishes loading in several web sites.</li> Fix the menu of select elements not showing in some cases under Wayland.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0005 2017-06-21T00:00:00+00:00 Date Reported: June 21, 2017 </li> Advisory ID: WSA-2017-0005 </li> CVE identifiers: CVE-2017-2538</a>, CVE-2017-2424</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-2538</a> Versions affected: WebKitGTK+ before 2.16.4.</li> Credit to Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2424</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Paul Thomson (using the GLFuzz tool) of the Multicore Programming Group, Imperial College London.</li> Impact: Processing maliciously crafted web content may result in the disclosure of process memory. Description: An information disclosure issue existed in the processing of OpenGL shaders. This issue was addressed through improved memory management.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.16.4 released! 2017-06-20T00:00:00+00:00 This is a bug fix release in the stable 2.16 series. What's new in the WebKitGTK+ 2.16.4 release?</h3> Fix web process deadlock when seeking youtube videos.</li> Fix blob downloads.</li> Improve theme rendering performance when using GTK+ >= 3.20.</li> Fix positioning of popup menus in Wayland.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2017-2538</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.17.4 released! 2017-06-19T00:00:00+00:00 This is a development release leading toward 2.18 series. What's new in the WebKitGTK+ 2.17.4 release?</h3> Add API to allow overriding popup menus.</li> Add kinetic scrolling support.</li> Improve theme rendering performance when using GTK+ >= 3.20.</li> Improve error message when webkit_web_view_run_javascript() fails due to a JavaScript exception.</li> Fix artifacts when rendering large images.</li> Fix blob downloads.</li> Fix web process deadlock when seeking youtube videos.</li> Fix alpha premultiplying when using cairo to draw the video frames.</li> Fix web process deadlock when closing the remote inspector frontend.</li> Update several web inspector icons.</li> Fix several crashes and rendering issues.</li> Translation updates: Spanish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0004 2017-05-25T00:00:00+00:00 Date Reported: May 25, 2017 </li> Advisory ID: WSA-2017-0004 </li> CVE identifiers: CVE-2017-2496</a>, CVE-2017-2504</a>, CVE-2017-2505</a>, CVE-2017-2506</a>, CVE-2017-2508</a>, CVE-2017-2510</a>, CVE-2017-2514</a>, CVE-2017-2515</a>, CVE-2017-2521</a>, CVE-2017-2525</a>, CVE-2017-2526</a>, CVE-2017-2528</a>, CVE-2017-2530</a>, CVE-2017-2531</a>, CVE-2017-2536</a>, CVE-2017-2539</a>, CVE-2017-2544</a>, CVE-2017-2547</a>, CVE-2017-2549</a>, CVE-2017-6980</a>, CVE-2017-6984</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-2496</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2504</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in the handling of WebKit Editor commands. This issue was addressed with improved state management.</li> </ul> </li> CVE-2017-2505</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2506</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to Zheng Huang of the Baidu Security Lab working with Trend Micro’s Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2508</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in the handling of WebKit container nodes. This issue was addressed with improved state management.</li> </ul> </li> CVE-2017-2510</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in the handling of pageshow events. This issue was addressed with improved state management.</li> </ul> </li> CVE-2017-2514</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2515</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2521</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2525</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2526</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2528</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in the handling of WebKit cached frames. This issue was addressed with improved state management.</li> </ul> </li> CVE-2017-2530</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to Wei Yuan of Baidu Security Lab.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2531</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2536</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to Samuel Groß and Niklas Baumstark working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2539</a> Versions affected: WebKitGTK+ before 2.16.3.</li> Credit to Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2544</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to 360 Security (@mj0011sec) working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2547</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to lokihardt of Google Project Zero, Team Sniper (Keen Lab and PC Mgr) working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-2549</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in frame loading. This issue was addressed with improved state management.</li> </ul> </li> CVE-2017-6980</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> CVE-2017-6984</a> Versions affected: WebKitGTK+ before 2.16.1.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.16.3 released! 2017-05-24T00:00:00+00:00 This is a bug fix release in the stable 2.16 series. What's new in the WebKitGTK+ 2.16.3 release?</h3> Fix URL shown in the title of beforeunload dialogs.</li> Focus first input field of HTTP authentication dialog.</li> Fix rendering glitches in HiDPI in long GitHub Gist pages when focusing the comments textarea.</li> Remove Firefox user agent quirk for Google domains.</li> Remove LATEST_RECORD_VERSION from GnuTLS priority string.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2017-2496</a>, CVE-2017-2539</a>, CVE-2017-2510</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.17.3 released! 2017-05-22T00:00:00+00:00 This is a development release leading toward 2.18 series. What's new in the WebKitGTK+ 2.17.3 release?</h3> Add new API to create a WebKitContextMenuItem from a GAction.</li> Fix graphics repaint hungs in accelerated compositing mode after a resize.</li> Fix rendering glitches in HiDPI in long GitHub Gist pages when focusing the comments textarea.</li> Remove Firefox user agent quirk for Google domains.</li> Remove LATEST_RECORD_VERSION from GnuTLS priority string.</li> Improve colors of inspector SVG icons.</li> Fix several crashes and rendering issues.</li> Translation updates: French.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.17.2 released! 2017-05-11T00:00:00+00:00 This is a development release leading toward 2.18 series. What's new in the WebKitGTK+ 2.17.2 release?</h3> Update user agent quirks to make Youtube and new Google login page work.</li> Fix URL shown in the title of beforeunload dialogs.</li> Focus first input field of HTTP authentication dialog.</li> Fix rendering of PNG images when decoded in more than one chunk.</li> Update several web inspector icons.</li> Fix the build with OpenGL disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.14.7 released! 2017-05-09T00:00:00+00:00 This is a bug fix release in the stable 2.14 series. What's new in the WebKitGTK+ 2.14.7 release?</h3> Update user agent quirks to make Youtube and new Google login page work.</li> Fix playing of some live streams.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.16.2 released! 2017-05-09T00:00:00+00:00 This is a bug fix release in the stable 2.16 series. What's new in the WebKitGTK+ 2.16.2 release?</h3> Update user agent quirks to make Youtube and new Google login page work.</li> Fix rendering of animated PNGs.</li> Fix playing of some live streams.</li> Update several web inspector icons.</li> Fix the build with NPAPI plugins enabled but X11 disabled.</li> Fix the build with OpenGL disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.17.1 released! 2017-05-03T00:00:00+00:00 This is the first development release leading toward 2.18 series. What's new in the WebKitGTK+ 2.17.1 release?</h3> Switch to use new remote inspector infraestructure instead of legacy Web Sockets based one.</li> Add API to enable and handle Web Automation.</li> Load large images asynchronously off the main theead.</li> Use GtkFileChooserNative for open/save dialogs when available.</li> Make file chooser run as modal by default if possible.</li> Fix position of dropdown menus in Wayland.</li> Keep URI fragments after a server redirection.</li> Implement support for aria-haspopup and aria-autocomplete.</li> Implement aria-value support for focusable separators.</li> Fix playing of some live streams.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.14.6 released! 2017-04-06T00:00:00+00:00 This is a bug fix release in the stable 2.14 series. What's new in the WebKitGTK+ 2.14.6 release?</h3> Fix rendering issues in long documents with transparent background.</li> Fix no-third-party cookies policy in case of redirections.</li> Honor GTK+ font settings.</li> Fix rendering artifacts when resizing the window in accelerated compositing mode.</li> Remove flickering when leaving accelerated compositing mode.</li> Fix web process deadlocks when destroying the media player.</li> Properly handle copy drag and drop operations.</li> Ensure we never try to load GTK2 plugins in Wayland.</li> Fix a hang when sending an IPC messages fails because socket read buffers are full.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2017-2369</a>, CVE-2017-2460</a>, CVE-2017-2470</a>, CVE-2017-2475</a>, CVE-2017-2481</a>, CVE-2017-2476</a>, CVE-2017-2471</a>, CVE-2017-2466</a>, CVE-2017-2459</a>, CVE-2017-2454</a>, CVE-2017-2446</a>, CVE-2017-2468</a>, CVE-2017-2465</a>, CVE-2016-9643</a>, CVE-2017-2377</a>, CVE-2017-2364</a>, CVE-2017-2367</a>, CVE-2017-2442</a>, CVE-2017-2419</a>, CVE-2017-2392</a>, CVE-2017-2405</a>, CVE-2017-2394</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0003 2017-04-06T00:00:00+00:00 Date Reported: April 06, 2017 </li> Advisory ID: WSA-2017-0003 </li> CVE identifiers: CVE-2016-9642</a>, CVE-2016-9643</a>, CVE-2017-2364</a>, CVE-2017-2367</a>, CVE-2017-2376</a>, CVE-2017-2377</a>, CVE-2017-2386</a>, CVE-2017-2392</a>, CVE-2017-2394</a>, CVE-2017-2395</a>, CVE-2017-2396</a>, CVE-2017-2405</a>, CVE-2017-2415</a>, CVE-2017-2419</a>, CVE-2017-2433</a>, CVE-2017-2442</a>, CVE-2017-2445</a>, CVE-2017-2446</a>, CVE-2017-2447</a>, CVE-2017-2454</a>, CVE-2017-2455</a>, CVE-2017-2457</a>, CVE-2017-2459</a>, CVE-2017-2460</a>, CVE-2017-2464</a>, CVE-2017-2465</a>, CVE-2017-2466</a>, CVE-2017-2468</a>, CVE-2017-2469</a>, CVE-2017-2470</a>, CVE-2017-2471</a>, CVE-2017-2475</a>, CVE-2017-2476</a>, CVE-2017-2481</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2016-9642</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Gustavo Grieco.</li> JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.</li> </ul> </li> CVE-2016-9643</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Gustavo Grieco.</li> The regex code in WebKit allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and a large number of +) (plus close parenthesis).</li> </ul> </li> CVE-2017-2364</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to lokihardt of Google Project Zero.</li> This issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.</li> </ul> </li> CVE-2017-2367</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to lokihardt of Google Project Zero.</li> This issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.</li> </ul> </li> CVE-2017-2376</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to an anonymous researcher, Chris Hlady of Google Inc, Yuyang Zhou of Tencent Security Platform Department (security.tencent.com), Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd., Michal Zalewski of Google Inc, an anonymous researcher.</li> This issue allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.</li> </ul> </li> CVE-2017-2377</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Vicki Pfau.</li> This issue involves the "WebKit Web Inspector" component. It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state.</li> </ul> </li> CVE-2017-2386</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to André Bargull.</li> This issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.</li> </ul> </li> CVE-2017-2392</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Max Bazaliy of Lookout.</li> This issue allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.</li> </ul> </li> CVE-2017-2394</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Apple.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2395</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Apple.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2396</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Apple.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2405</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Apple.</li> This issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2415</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Kai Kang of Tencent's Xuanwu Lab (tentcent.com).</li> This issue allows remote attackers to execute arbitrary code by leveraging an unspecified "type confusion.".</li> </ul> </li> CVE-2017-2419</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Nicolai Grødum of Cisco Systems.</li> This issue allows remote attackers to bypass a Content Security Policy protection mechanism via unspecified vectors.</li> </ul> </li> CVE-2017-2433</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Apple.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2442</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to lokihardt of Google Project Zero.</li> This issue involves the "WebKit JavaScript Bindings" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.</li> </ul> </li> CVE-2017-2445</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to lokihardt of Google Project Zero.</li> This issue allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.</li> </ul> </li> CVE-2017-2446</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Natalie Silvanovich of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code via a crafted web site that leverages the mishandling of strict mode functions.</li> </ul> </li> CVE-2017-2447</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Natalie Silvanovich of Google Project Zero.</li> This issue allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted web site.</li> </ul> </li> CVE-2017-2454</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> This issue allows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2455</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Ivan Fratric of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2457</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to lokihardt of Google Project Zero.</li> This issue allows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2459</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2460</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2464</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to Jeonghoon Shin, Natalie Silvanovich of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2465</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Zheng Huang and Wei Yuan of Baidu Security Lab.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2466</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2468</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to lokihardt of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2469</a> Versions affected: WebKitGTK+ before 2.16.0.</li> Credit to lokihardt of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2470</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to lokihardt of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2471</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> A use-after-free vulnerability allows remote attackers to execute arbitrary code via a crafted web site.</li> </ul> </li> CVE-2017-2475</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to lokihardt of Google Project Zero.</li> This issue allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames on a web site.</li> </ul> </li> CVE-2017-2476</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to Ivan Fratric of Google Project Zero.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2017-2481</a> Versions affected: WebKitGTK+ before 2.14.6.</li> Credit to 0011 working with Trend Micro's Zero Day Initiative.</li> This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.16.1 released! 2017-04-04T00:00:00+00:00 This is the first bug fix release in the stable 2.16 series. What's new in the WebKitGTK+ 2.16.1 release?</h3> Fix no-third-party cookies policy in case of redirections.</li> Keep URL fragments after server redirections.</li> Honor GTK+ font settings.</li> Ensure depth and stencil renderbuffers are created on GLESv2.</li> Prevent new navigations from onbeforeunload handler and document unload.</li> Disallow beforeunload alerts from web pages users have never interacted with.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.16.0 released! 2017-03-20T00:00:00+00:00 This is the first stable release in the 2.16 series. Highlights of the WebKitGTK+ 2.16.0 release</h3> Hardware acceleration is now enabled on demand to drastically reduce memory consumption.</li> CSS Grid Layout is enabled by default.</li> New WebKitSetting to set the hardware acceleration policy.</li> UI process API to configure network proxy settings.</li> Improved private browsing by adding new API to create ephemeral web views.</li> New API to handle website data.</li> Debug tools: memory sampler and resource usage overlay</li> </ul> For more details about all the changes included in WebKitGTK+ 2.16 see the NEWS file that is included in the tarball, or see: http://blogs.igalia.com/carlosgc/2017/03/20/webkitgtk-2-16/</a> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.15.92 released! 2017-03-14T00:00:00+00:00 This is a development release leading toward 2.16 series. What's new in the WebKitGTK+ 2.15.92 release?</h3> Show the context menu when triggered by the keyboard.</li> Fix web process deadlocks when destroying the media player.</li> Fix web process crashes when loading animated GIFs.</li> Fix several crashes and rendering issues.</li> Translation updates: Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.15.91 released! 2017-03-01T00:00:00+00:00 This is a development release leading toward 2.16 series. What's new in the WebKitGTK+ 2.15.91 release?</h3> Fix rendering artifacts when resizing the window in accelerated compositing mode.</li> Remove flickering when leaving accelerated compositing mode.</li> Fix a web process crash when loading duck duck go.</li> Properly handle copy drag and drop operations.</li> Fix a hang when sending an IPC messages fails because socket read buffers are full.</li> Ensure we never try to load GTK2 plugins in Wayland.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.15.90 released! 2017-02-20T00:00:00+00:00 This is a development release leading toward 2.16 series. What's new in the WebKitGTK+ 2.15.90 release?</h3> Add an API to add a custom tab into the print dialog.</li> Update cookie manager API to properly work with ephemeral sessions.</li> Fix rendering issues in long documents with transparent background.</li> Handle extended colors in cairo and texture mapper backends.</li> Release unused UpdateAtlas and reduce the tile coverage on memory pressure.</li> The media backend now stores preloaded media in /var/tmp instead of user cache dir.</li> Fix a deadlock when the media player is destroyed.</li> Fast replay on video hide/unhide on platforms with limited video buffer pools.</li> Fix network process crashes when loading custom URI schemes.</li> Fix video rendering when switching to accelerated compositing mode.</li> Fix several crashes and rendering issues.</li> Translation updates: Brazilian Portuguese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.14.5 released! 2017-02-15T00:00:00+00:00 This is a bug fix release in the stable 2.14 series. What's new in the WebKitGTK+ 2.14.5 release?</h3> Fix rendering of non-accelerated contents with HiDPI.</li> Revert the fix for rendering issues in long documents with transparent background because it caused issues in HiDPI.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.14.4 released! 2017-02-10T00:00:00+00:00 This is a bug fix release in the stable 2.14 series. What's new in the WebKitGTK+ 2.14.4 release?</h3> Make accelerating compositing mode on-demand again. By default it will only be used for websites that require it, saving a lot of memory on websites that don't need it.</li> Fix rendering issues in long documents with transparent background.</li> Release unused UpdateAtlas and reduce the tile coverage on memory pressure.</li> The media backend now stores preloaded media in /var/tmp instead of user cache dir.</li> Make inspector work again when accelerated compositing support is disabled.</li> Fix a deadlock when the media player is destroyed.</li> Fix network process crashes when loading custom URI schemes.</li> Fix overlay scrollbars that are over a subframe.</li> Fix a crash in GraphicsContext3D::drawArrays when using OpenGL 3.2 core profile.</li> Fix BadDamage X errors happening when resizing the WebView.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2017-2365</a>, CVE-2017-2366</a>, CVE-2017-2373</a>, CVE-2017-2363</a>, CVE-2017-2362</a>, CVE-2017-2350</a>, CVE-2017-2350</a>, CVE-2017-2354</a>, CVE-2017-2355</a>, CVE-2017-2356</a>, CVE-2017-2371</a>, CVE-2017-2364</a>, CVE-2017-2369</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0002 2017-02-10T00:00:00+00:00 Date Reported: February 10, 2017 </li> Advisory ID: WSA-2017-0002 </li> CVE identifiers: CVE-2017-2350</a>, CVE-2017-2354</a>, CVE-2017-2355</a>, CVE-2017-2356</a>, CVE-2017-2362</a>, CVE-2017-2363</a>, CVE-2017-2364</a>, CVE-2017-2365</a>, CVE-2017-2366</a>, CVE-2017-2369</a>, CVE-2017-2371</a>, CVE-2017-2373</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2017-2350</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to Gareth Heyes of Portswigger Web Security.</li> Impact: Processing maliciously crafted web content may exfiltrate data cross-origin. Description: A prototype access issue was addressed through improved exception handling.</li> </ul> </li> CVE-2017-2354</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to Neymar of Tencent's Xuanwu Lab (tencent.com) working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> CVE-2017-2355</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to Team Pangu and lokihardt at PwnFest 2016.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory initialization issue was addressed through improved memory handling.</li> </ul> </li> CVE-2017-2356</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to Team Pangu and lokihardt at PwnFest 2016.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved input validation.</li> </ul> </li> CVE-2017-2362</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> CVE-2017-2363</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may exfiltrate data cross-origin. Description: Multiple validation issues existed in the handling of page loading. This issue was addressed through improved logic.</li> </ul> </li> CVE-2017-2364</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may exfiltrate data cross-origin. Description: Multiple validation issues existed in the handling of page loading. This issue was addressed through improved logic.</li> </ul> </li> CVE-2017-2365</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to lokihardt of Google Project Zero.</li> Impact: Processing maliciously crafted web content may exfiltrate data cross-origin. Description: A validation issue existed in variable handling. This issue was addressed through improved validation.</li> </ul> </li> CVE-2017-2366</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to Kai Kang of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved input validation.</li> </ul> </li> CVE-2017-2369</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved input validation.</li> </ul> </li> CVE-2017-2371</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to lokihardt of Google Project Zero.</li> Impact: A malicious website can open popups. Description: An issue existed in the handling of blocking popups. This was addressed through improved input validation.</li> </ul> </li> CVE-2017-2373</a> Versions affected: WebKitGTK+ before 2.14.4.</li> Credit to Ivan Fratric of Google Project Zero.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.15.4 released! 2017-01-31T00:00:00+00:00 This is a development release leading toward 2.16 series. What's new in the WebKitGTK+ 2.15.4 release?</h3> Make accelerating compositing mode on-demand again. By default it will only be used for websites that require it, saving a lot of memory on websites that don't need it.</li> Add API to manage hardware acceleration policy.</li> Enable CSS Grid Layout by default.</li> Add API to create ephemeral WebViews to replace the legacy private browsing setting that is now deprecated.</li> Handle HTTP authentication for downloads having a WebView associated.</li> Add API to WebKitWebsiteDataManager to handle websites data.</li> Fix BadDamage X errors happening when resizing the WebView.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.15.3 released! 2017-01-20T00:00:00+00:00 This is a development release leading toward 2.16 series. What's new in the WebKitGTK+ 2.15.3 release?</h3> Add API to set network proxy settings.</li> Add API to set initial notification permissions.</li> Add WebKitSecurityOrigin to the API.</li> Add tag property to WebKitNotification.</li> Create GLX OpenGL contexts using version 3.2 (core profile) when available to reduce the memory consumption on Mesa based drivers.</li> Improve memory pressure handler to reduce the CPU usage on memory pressure situations.</li> Add support for key and code properties on keyboard events.</li> More user agent string improvements to improve compatibility with several websites.</li> Fix network process crashes when loading custom URI schemes.</li> Fix web process crash when closing the web view in X11.</li> Fix several crashes and rendering issues.</li> Translation updates: German.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.14.3 released! 2017-01-17T00:00:00+00:00 This is a bug fix release in the stable 2.14 series. What's new in the WebKitGTK+ 2.14.3 release?</h3> Create GLX OpenGL contexts using version 3.2 (core profile) when available to reduce the memory consumption on Mesa based drivers.</li> Improve memory pressure handler to reduce the CPU usage on memory pressure situations.</li> Fix a regression in WebKitWebView title notify signal emission that caused the signal to be emitted multiple times.</li> Fix high CPU usage in the web process loading hyphenation dictionaries.</li> More user agent string improvements to improve compatibility with several websites.</li> Fix web process crash when closing the web view in X11.</li> Fix the build with OpenGL ES2 enabled.</li> Fix several crashes and rendering issues.</li> Translation updates: German.</li> Security fixes: CVE-2016-7656</a>, CVE-2016-7635</a>, CVE-2016-7654</a>, CVE-2016-7639</a>, CVE-2016-7645</a>, CVE-2016-7652</a>, CVE-2016-7641</a>, CVE-2016-7632</a>, CVE-2016-7599</a>, CVE-2016-7592</a>, CVE-2016-7589</a>, CVE-2016-7623</a>, CVE-2016-7586</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2017-0001 2017-01-17T00:00:00+00:00 Date Reported: January 17, 2017 </li> Advisory ID: WSA-2017-0001 </li> CVE identifiers: CVE-2016-4692</a>, CVE-2016-4743</a>, CVE-2016-7586</a>, CVE-2016-7587</a>, CVE-2016-7589</a>, CVE-2016-7592</a>, CVE-2016-7598</a>, CVE-2016-7599</a>, CVE-2016-7610</a>, CVE-2016-7611</a>, CVE-2016-7623</a>, CVE-2016-7632</a>, CVE-2016-7635</a>, CVE-2016-7639</a>, CVE-2016-7640</a>, CVE-2016-7641</a>, CVE-2016-7642</a>, CVE-2016-7645</a>, CVE-2016-7646</a>, CVE-2016-7648</a>, CVE-2016-7649</a>, CVE-2016-7652</a>, CVE-2016-7654</a>, CVE-2016-7656</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2016-4692</a> Versions affected: WebKitGTK+ before 2.14.1.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> CVE-2016-4743</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Alan Cutter.</li> Impact: Processing maliciously crafted web content may result in the disclosure of process memory. Description: A memory corruption issue was addressed through improved input validation.</li> </ul> </li> CVE-2016-7586</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Boris Zbarsky.</li> Impact: Processing maliciously crafted web content may result in the disclosure of user information. Description: A validation issue was addressed through improved state management.</li> </ul> </li> CVE-2016-7587</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Adam Klein.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7589</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed through improved state management.</li> </ul> </li> CVE-2016-7592</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to xisigr of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may compromise user information. Description: An issue existed in handling of JavaScript prompts. This was addressed through improved state management.</li> </ul> </li> CVE-2016-7598</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Samuel Groß.</li> Impact: Processing maliciously crafted web content may result in the disclosure of process memory. Description: An uninitialized memory access issue was addressed through improved memory initialization.</li> </ul> </li> CVE-2016-7599</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd.</li> Impact: Processing maliciously crafted web content may result in the disclosure of user information. Description: An issue existed in the handling of HTTP redirects. This issue was addressed through improved cross origin validation.</li> </ul> </li> CVE-2016-7610</a> Versions affected: WebKitGTK+ before 2.14.1.</li> Credit to Zheng Huang of the Baidu Security Lab working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7611</a> Versions affected: WebKitGTK+ before 2.14.2.</li> Credit to an anonymous researcher working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7623</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to xisigr of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Visiting a maliciously crafted website may compromise user information. Description: An issue existed in the handling of blob URLs. This issue was addressed through improved URL handling.</li> </ul> </li> CVE-2016-7632</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Jeonghoon Shin.</li> Impact: Visiting a maliciously crafted webpage may lead to an unexpected application termination or arbitrary code execution. Description: A memory corruption issue was addressed through improved state management.</li> </ul> </li> CVE-2016-7635</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> CVE-2016-7639</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Tongbo Luo of Palo Alto Networks.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7640</a> Versions affected: WebKitGTK+ before 2.14.2.</li> Credit to Kai Kang of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7641</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Kai Kang of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7642</a> Versions affected: WebKitGTK+ before 2.14.2.</li> Credit to Tongbo Luo of Palo Alto Networks.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7645</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Kai Kang of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7646</a> Versions affected: WebKitGTK+ before 2.14.2.</li> Credit to Kai Kang of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7648</a> Versions affected: WebKitGTK+ before 2.14.2.</li> Credit to Kai Kang of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7649</a> Versions affected: WebKitGTK+ before 2.14.2.</li> Credit to Kai Kang of Tencent's Xuanwu Lab (tencent.com).</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7652</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> CVE-2016-7654</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Keen Lab working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-7656</a> Versions affected: WebKitGTK+ before 2.14.3.</li> Credit to Keen Lab working with Trend Micro's Zero Day Initiative.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed through improved state management.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.15.2 released! 2016-11-21T00:00:00+00:00 This is a development release leading toward 2.16 series. What's new in the WebKitGTK+ 2.15.2 release?</h3> Add new API to notify about dynamically added forms to Web Extensions.</li> Implement selection interface and states for elements supporting aria-selected and for menu roles.</li> Expose STATE_SINGLE_LINE and STATE_MULTI_LINE for ARIA searchbox role.</li> Enable WebMemorySampler.</li> Downloads started by context menu actions now have a web view associated.</li> Fix a network process crash when main resource load is converted into a download.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2016-0006 2016-11-04T00:00:00+00:00 Date Reported: November 04, 2016 </li> Advisory ID: WSA-2016-0006 </li> CVE identifiers: CVE-2016-4611</a>, CVE-2016-4613</a>, CVE-2016-4657</a>, CVE-2016-4666</a>, CVE-2016-4707</a>, CVE-2016-4728</a>, CVE-2016-4729</a>, CVE-2016-4730</a>, CVE-2016-4731</a>, CVE-2016-4733</a>, CVE-2016-4734</a>, CVE-2016-4735</a>, CVE-2016-4758</a>, CVE-2016-4759</a>, CVE-2016-4760</a>, CVE-2016-4761</a>, CVE-2016-4762</a>, CVE-2016-4764</a>, CVE-2016-4765</a>, CVE-2016-4766</a>, CVE-2016-4767</a>, CVE-2016-4768</a>, CVE-2016-4769</a>, CVE-2016-7578</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2016-4611</a> Versions affected: WebKitGTK+ before 2.12.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4730, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735.</li> </ul> </li> CVE-2016-4613</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Chris Palmer.</li> Impact: Processing maliciously crafted web content may result in the disclosure of user information. Description: An input validation issue was addressed through improved state management.</li> </ul> </li> CVE-2016-4657</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Citizen Lab and Lookout.</li> WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.</li> </ul> </li> CVE-2016-4666</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> CVE-2016-4707</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Anonymous Researcher.</li> CFNetwork in Apple iOS before 10 and OS X before 10.12 mishandles Local Storage deletion, which allows local users to discover the visited web sites of arbitrary users via unspecified vectors.</li> </ul> </li> CVE-2016-4728</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Daniel Divricean.</li> WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site.</li> </ul> </li> CVE-2016-4729</a> Versions affected: WebKitGTK+ before 2.12.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4731.</li> </ul> </li> CVE-2016-4730</a> Versions affected: WebKitGTK+ before 2.12.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735.</li> </ul> </li> CVE-2016-4731</a> Versions affected: WebKitGTK+ before 2.12.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4729.</li> </ul> </li> CVE-2016-4733</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Natalie Silvanovich of Google Project Zero.</li> WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4734, and CVE-2016-4735.</li> </ul> </li> CVE-2016-4734</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Natalie Silvanovich of Google Project Zero.</li> WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4735.</li> </ul> </li> CVE-2016-4735</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to André Bargull.</li> WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4734.</li> </ul> </li> CVE-2016-4758</a> Versions affected: WebKitGTK+ before 2.12.1.</li> Credit to Masato Kinugawa of Cure53.</li> WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.</li> </ul> </li> CVE-2016-4759</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Tongbo Luo of Palo Alto Networks.</li> WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4765, CVE-2016-4766, CVE-2016-4767, and CVE-2016-4768.</li> </ul> </li> CVE-2016-4760</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Jordan Milne.</li> WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 support.</li> </ul> </li> CVE-2016-4761</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Apple.</li> An use-after-free vulnerability allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.</li> </ul> </li> CVE-2016-4762</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Zheng Huang of Baidu Security Lab.</li> WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, iCloud before 6.0 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.</li> </ul> </li> CVE-2016-4764</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved state management.</li> </ul> </li> CVE-2016-4765</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4766, CVE-2016-4767, and CVE-2016-4768.</li> </ul> </li> CVE-2016-4766</a> Versions affected: WebKitGTK+ before 2.12.4.</li> Credit to Apple.</li> WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4767, and CVE-2016-4768.</li> </ul> </li> CVE-2016-4767</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4768.</li> </ul> </li> CVE-2016-4768</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Anonymous working with Trend Micro's Zero Day Initiative.</li> WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4767.</li> </ul> </li> CVE-2016-4769</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Tongbo Luo of Palo Alto Networks.</li> WebKit in Apple iTunes before 12.5.1 on Windows and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> CVE-2016-7578</a> Versions affected: WebKitGTK+ before 2.14.0.</li> Credit to Apple.</li> Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.14.2 released! 2016-11-03T00:00:00+00:00 This is a bug fix release in the stable 2.14 series. What's new in the WebKitGTK+ 2.14.2 release?</h3> Expose WebKitDOMHTMLInputElement APIs for form autofill in unstable DOM API.</li> Properly update WebKitWebView and WebKitWebPage URI properties when request is modified by WebKitWebPage:send-request signal.</li> Restore user agent quirk for Yahoo.</li> Dot not leak the default WebKitWebsiteDataManager in WebKitWebContext.</li> Use eglGetPlatformDisplay when available instead of eglGetDisplay.</li> Avoid strstr() when checking (E)GL extensions.</li> Fix several crashes and rendering issues.</li> Fix the build with ENABLE_OPENGL=OFF and allow to build on Wayland without OpenGL again.</li> Translation updates: Hungarian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.15.1 released! 2016-10-26T00:00:00+00:00 This is the first development release leading toward 2.16 series. What's new in the WebKitGTK+ 2.15.1 release?</h3> GObject DOM bindings API marked as unstable has been removed.</li> Expose WebKitDOMHTMLInputElement APIs for form autofill.</li> Properly update WebKitWebView and WebKitWebPage URI properties when request is modified by WebKitWebPage:send-request signal.</li> Switch to use GMenu internally in the context menu implementation.</li> Dot not leak the default WebKitWebsiteDataManager in WebKitWebContext.</li> The network backend now always sniff contents for Downloads.</li> Use eglGetPlatformDisplay when available instead of eglGetDisplay.</li> Avoid strstr() when checking (E)GL extensions.</li> Fix the build with ENABLE_OPENGL=OFF and allow to build on Wayland without OpenGL again.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.14.1 released! 2016-10-11T00:00:00+00:00 This is the first bug fix release in the stable 2.14 series. What's new in the WebKitGTK+ 2.14.1 release?</h3> MiniBrowser and jsc binaries are now installed in pkglibexecdir instead of bindir.</li> Improve performance when resizing a window with multiple web views in X11.</li> Check whether GDK can use GL before using gdk_cairo_draw_from_gl() in Wayland.</li> Updated default UserAgent string or better compatibility.</li> Fix a crash on github.com in IntlDateTimeFormat::resolvedOptions when using the C locale.</li> Fix BadDamage X errors when closing the web view in X11.</li> Fix UIProcess crash when using Japanese input method.</li> Fix build with clang due to missing header includes.</li> Fix the build with USE_REDIRECTED_XCOMPOSITE_WINDOW disabled.</li> Fix several crashes and rendering issues.</li> Translation updates: German.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.14.0 released! 2016-09-20T00:00:00+00:00 This is the first stable release in the 2.14 series. Highlights of the WebKitGTK+ 2.14.0 release</h3> Threaded compositor is enabled by default in both X11 and Wayland.</li> Accelerated compositing is now supported in Wayland.</li> Clipboard works in Wayland too.</li> Memory pressure handler always works even when cgroups is not present or not configured.</li> The HTTP disk cache implements speculative revalidation of resources.</li> DRI3 is no longer a problem when using the modesetting intel driver.</li> The amount of file descriptors that are kept open has been drastically reduced.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.14 see the NEWS file that is included in the tarball, or see: http://blogs.igalia.com/carlosgc/2016/09/20/webkitgtk-2-14/</a> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.13.92 released! 2016-09-15T00:00:00+00:00 This is a development release leading toward 2.14 series. What's new in the WebKitGTK+ 2.13.92 release?</h3> Add clipboard support in Wayland.</li> Improve rendering of scrollbars with themes setting a minimum width for the scrollbar CSS gadget.</li> Fix another WebProcess crash when the last WebView is destroyed.</li> Fix the build with GCC 6.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.13.91 released! 2016-09-09T00:00:00+00:00 This is a development release leading toward 2.14 series. What's new in the WebKitGTK+ 2.13.91 release?</h3> Improve the performance when resizing the WebView with the threaded compositor.</li> Do not try to use GL_PACK_ROW_LENGTH when compiling with GLES2, since it's not available.</li> Use a different plugins cache file in Wayland and X11.</li> Fix UI process crash visiting sites protected with HTTP auth when using GTK+ < 3.14.</li> Fix a WebProcess crash when the last WebView is destroyed.</li> Fix build configure without Wayland support.</li> Fix the build when compiling with Clang.</li> Fix several crashes and rendering issues.</li> Translation updates: Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.12.5 released! 2016-09-05T00:00:00+00:00 This is a bug fix release in the stable 2.12 series. What's new in the WebKitGTK+ 2.12.5 release?</h3> Fix a regression introduced in 2.12.4 that caused a hang in the network process after a load failure.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.13.90 released! 2016-08-31T00:00:00+00:00 This is a development release leading toward 2.14 series. What's new in the WebKitGTK+ 2.13.90 release?</h3> Add initial implementation of accelerating compositing support under Wayland.</li> Fix performance with the modesetting intel driver and DRI3 enabled.</li> Improved performance when resizing the web view on X11.</li> Fix several crashes and rendering issues.</li> Translation updates: German, Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2016-0005 2016-08-25T00:00:00+00:00 Date Reported: August 25, 2016 </li> Advisory ID: WSA-2016-0005 </li> CVE identifiers: CVE-2016-4583</a>, CVE-2016-4585</a>, CVE-2016-4586</a>, CVE-2016-4587</a>, CVE-2016-4588</a>, CVE-2016-4589</a>, CVE-2016-4590</a>, CVE-2016-4591</a>, CVE-2016-4592</a>, CVE-2016-4622</a>, CVE-2016-4623</a>, CVE-2016-4624</a>, CVE-2016-4651</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2016-4583</a> Versions affected: WebKitGTK+ before 2.12.2.</li> Credit to Roeland Krak.</li> WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.</li> </ul> </li> CVE-2016-4585</a> Versions affected: WebKitGTK+ before 2.12.1.</li> Credit to Takeshi Terada of Mitsui Bussan Secure Directions, Inc. (www.mbsd.jp).</li> Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.</li> </ul> </li> CVE-2016-4586</a> Versions affected: WebKitGTK+ before 2.12.1.</li> Credit to Apple.</li> WebKit in Apple Safari before 9.1.2 and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.</li> </ul> </li> CVE-2016-4587</a> Versions affected: WebKitGTK+ before 2.10.1.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.3.3 and tvOS before 9.2.2 allows remote attackers to obtain sensitive information from uninitialized process memory via a crafted web site.</li> </ul> </li> CVE-2016-4588</a> Versions affected: WebKitGTK+ before 2.12.3.</li> Credit to Apple.</li> WebKit in Apple tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.</li> </ul> </li> CVE-2016-4589</a> Versions affected: WebKitGTK+ before 2.12.3.</li> Credit to Tongbo Luo and Bo Qu of Palo Alto Networks.</li> WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4622, CVE-2016-4623, and CVE-2016-4624.</li> </ul> </li> CVE-2016-4590</a> Versions affected: WebKitGTK+ before 2.12.4.</li> Credit to xisigr of Tencent's Xuanwu Lab (www.tencent.com).</li> WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.</li> </ul> </li> CVE-2016-4591</a> Versions affected: WebKitGTK+ before 2.12.4.</li> Credit to ma.la of LINE Corporation.</li> WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.</li> </ul> </li> CVE-2016-4592</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Mikhail.</li> WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted web site.</li> </ul> </li> CVE-2016-4622</a> Versions affected: WebKitGTK+ before 2.12.4.</li> Credit to Samuel Gross working with Trend Micro's Zero Day Initiative.</li> WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624.</li> </ul> </li> CVE-2016-4623</a> Versions affected: WebKitGTK+ before 2.12.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4624.</li> </ul> </li> CVE-2016-4624</a> Versions affected: WebKitGTK+ before 2.12.4.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4623.</li> </ul> </li> CVE-2016-4651</a> Versions affected: WebKitGTK+ before 2.12.0.</li> Credit to Obscure.</li> Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.12.4 released! 2016-08-24T00:00:00+00:00 This is a bug fix release in the stable 2.12 series. What's new in the WebKitGTK+ 2.12.4 release?</h3> Fix performance in accelerated compositing mode with the modesetting intel driver and DRI3 enabled.</li> Reduce the amount of file descriptors that the Web Process keeps open.</li> Fix Web Process deadlocks when loading HLS videos.</li> Make CSS and SVG animations run at 60fps.</li> Make meter elements accessible.</li> Improve accessibility name and description of elements to make it more compatible with W3C specs and fix several bugs in which the accessible name of objects was missing or broken.</li> Fix a crash when running windowed plugins under Wayland.</li> Fix a crash at process exit under Wayland.</li> Fix several crashes and rendering issues.</li> Translation updates: German.</li> Security fixes: CVE-2016-4622</a>, CVE-2016-4624</a>, CVE-2016-4591</a>, CVE-2016-4590</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.13.4 released! 2016-07-27T00:00:00+00:00 This is a development release leading toward 2.14 series. What's new in the WebKitGTK+ 2.13.4 release?</h3> Switched to use the threaded compositor. Accelerated compositing mode is now always enabled by default and happens in a separate thread in the web process.</li> Make web view background colors work in accelerated compositing mode.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.13.3 released! 2016-07-18T00:00:00+00:00 This is a development release leading toward 2.14 series. What's new in the WebKitGTK+ 2.13.3 release?</h3> Fix Web Process deadlocks when loading HLS videos.</li> Make videos work when painted into a canvas when accelerated compositing is enabled.</li> Fix flickering with animated GIFs.</li> Fix a Web Process crash when video repaint is requested with GStreamer GL enabled.</li> Reduce the amount of file descriptors that the Web Process keeps open.</li> Make memory pressure handler work when cgroups are not available.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.13.2 released! 2016-06-23T00:00:00+00:00 This is a development release leading toward 2.14 series. What's new in the WebKitGTK+ 2.13.2 release?</h3> Properly redraw the web view when reparented in force compositing mode.</li> Flip the volume control layout in media controls on RTL.</li> Add support for video orientation to the GStreamer media backend.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.13.1 released! 2016-05-31T00:00:00+00:00 This is the first development release leading toward 2.14 series. What's new in the WebKitGTK+ 2.13.1 release?</h3> CSS Grid Layout has been unprefixed and can be enabled as an experimental feature at runtime.</li> The HTTP disk cache implements speculative resources revalidation.</li> Add a new WebKitSetting to allow universal access from file URLs.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2016-0004 2016-05-30T00:00:00+00:00 Date Reported: May 30, 2016 </li> Advisory ID: WSA-2016-0004 </li> CVE identifiers: CVE-2016-1854</a>, CVE-2016-1856</a>, CVE-2016-1857</a>, CVE-2016-1858</a>, CVE-2016-1859</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2016-1854</a> Versions affected: WebKitGTK+ before 2.12.1.</li> Credit to Anonymous working with Trend Micro's Zero Day Initiative.</li> WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and CVE-2016-1857.</li> </ul> </li> CVE-2016-1856</a> Versions affected: WebKitGTK+ before 2.12.1.</li> Credit to lokihardt working with Trend Micro's Zero Day Initiative.</li> WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857.</li> </ul> </li> CVE-2016-1857</a> Versions affected: WebKitGTK+ before 2.12.3.</li> Credit to Jeonghoon Shin@A.D.D and Liang Chen, Zhen Feng, wushi of KeenLab, Tencent working with Trend Micro's Zero Day Initiative.</li> WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856.</li> </ul> </li> CVE-2016-1858</a> Versions affected: WebKitGTK+ before 2.12.0.</li> Credit to Anonymous.</li> WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, improperly tracks taint attributes, which allows remote attackers to obtain sensitive information via a crafted web site.</li> </ul> </li> CVE-2016-1859</a> Versions affected: WebKitGTK+ before 2.12.1.</li> Credit to Liang Chen, wushi of KeenLab, Tencent working with Trend Micro's Zero Day Initiative.</li> The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.12.3 released! 2016-05-24T00:00:00+00:00 This is a bug fix release in the stable 2.12 series. What's new in the WebKitGTK+ 2.12.3 release?</h3> Improved the detection of supported MIME types supported by the media player.</li> Fix web process crash when playing adaptive streaming media.</li> Change the volume while thumb slider is dragged, not only when released.</li> Fix leaked thread in network process.</li> Fix several crashes and rendering issues.</li> Translation updates: Hungarian.</li> Security fixes: CVE-2016-1857</a>, CVE-2016-1856</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.12.2 released! 2016-04-28T00:00:00+00:00 This is a bug fix release in the stable 2.12 series. What's new in the WebKitGTK+ 2.12.2 release?</h3> Fix rendering of scrollbars with GTK themes using stepper buttons.</li> Fix compatibility issue with 2.12.1 regarding local storage access from file URLs.</li> Make menu list buttons use the text color from the theme.</li> Do not show resize grip in non-resizable text fields.</li> Fix accessibility events causing Orca to echo key presses instead of speaking the inserted characters in password fields.</li> Fix an off by one error in hyphenation.</li> Fix several crashes and rendering issues.</li> Fix the build with libjpeg v9.</li> Translation updates: Bulgarian, Finnish, Greek, Italian, Turkish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.12.1 released! 2016-04-14T00:00:00+00:00 This is the first bug fix release in the stable 2.12 series. What's new in the WebKitGTK+ 2.12.1 release?</h3> Fix spotify player.</li> Improve themed control elements rendering to better match GTK+ widgets.</li> Make remote web inspector work again.</li> Fix several crashes and rendering issues.</li> Fix several memory leaks.</li> Fix the build in Linux / PowerPC.</li> Fix detection of S390X and PPC64 architectures.</li> Fix the build in glibc-based BSD systems</li> Translation updates: Brazilian Portuguese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.11 released! 2016-04-10T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.11 release?</h3> Fix a crash when changing elment attributes with DOM bindings.</li> Fix the build on ARM64.</li> Translation updates: Chinese, Japanese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2016-0003 2016-03-31T00:00:00+00:00 Date Reported: March 31, 2016 </li> Advisory ID: WSA-2016-0003 </li> CVE identifiers: CVE-2016-1778</a>, CVE-2016-1779</a>, CVE-2016-1781</a>, CVE-2016-1782</a>, CVE-2016-1783</a>, CVE-2016-1785</a>, CVE-2016-1786</a>. </li> </ul> Several vulnerabilities were discovered in WebKitGTK+. CVE-2016-1778</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to 0x1byte working with Trend Micro's Zero Day Initiative (ZDI).</li> WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.</li> </ul> </li> CVE-2016-1779</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to xisigr of Tencent's Xuanwu Lab (http://www.tencent.com).</li> WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical- location data via a crafted geolocation request.</li> </ul> </li> CVE-2016-1781</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Devdatta Akhawe of Dropbox, Inc.</li> WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors.</li> </ul> </li> CVE-2016-1782</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Muneaki Nishimura (nishimunea) of Recruit Technologies Co.,Ltd.</li> WebKit in Apple iOS before 9.3 and Safari before 9.1 does not properly restrict redirects that specify a TCP port number, which allows remote attackers to bypass intended port restrictions via a crafted web site.</li> </ul> </li> CVE-2016-1783</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Mihai Parparita of Google.</li> WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.</li> </ul> </li> CVE-2016-1785</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to an anonymous researcher.</li> The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.</li> </ul> </li> CVE-2016-1786</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to ma.la of LINE Corporation.</li> The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, which allows remote attackers to spoof the displayed URL, bypass the Same Origin Policy, and obtain sensitive cached information via a crafted web site.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.12.0 released! 2016-03-22T00:00:00+00:00 This is the first stable release in the 2.12 series. Highlights of the WebKitGTK+ 2.12.0 release</h3> Enable FTL by default in JavaScriptCore for x86_64.</li> Network process is now used unconditionally. The shared secondary process model is now the same as using the multiple process model and setting a process limit of 1.</li> Switch to use overlay scrollbars like all other GTK+ widgets and ensure the behavior is consistent with GTK+ too.</li> Support for windowless NPAPI plugins with no UI in non X11 platforms.</li> Enable GSS-Negotiate support when available in libsoup.</li> Improved general performance by better handling glib main loop sources.</li> New API to save and restore a WebView session.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.12 see the NEWS file that is included in the tarball, or see: http://blogs.igalia.com/carlosgc/2016/03/22/webkitgtk-2-12/</a> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.9 released! 2016-03-17T00:00:00+00:00 This is a bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.9 release?</h3> Revert the patch to limit the number of tiles according to the visible area introduced in 2.10.8, because it caused rendering issues in several popular websites.</li> Fix the build with musl libc library.</li> Fix the build with clang-3.8.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.11.92 released! 2016-03-16T00:00:00+00:00 This is a development release leading toward 2.12 series. What's new in the WebKitGTK+ 2.11.92 release?</h3> Revert the patch to limit the number of tiles according to the visible area introduced in 2.11.90, because it caused rendering issues in several popular websites.</li> Fix scrollbars rendering again with GTK+ >= 3.19.11.</li> Fix rendering of slider input elements.</li> Fix rendering artifacts when using a web view background color.</li> Make webkit_web_context_clear_cache() work again.</li> Fix smooth scrolling behavior that was changed by mistake.</li> Don't force ENABLE_INTROSPECTION=OFF on Mac.</li> Install WebProcess and NetworkProcess on OSX when not building the Mac port.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.10 released! 2016-03-14T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.10 release?</h3> Fix rendering of form controls and scrollbars with GTK+ >= 3.19</li> Fix crashes on PPC64.</li> Fix the build on powerpc 32 bits.</li> Add ARM64 build support.</li> Translation updates: German, Spanish, French, Italian, Korean, Brazilian Portuguese, Russian, Chinese.</li> Security fixes: CVE-2015-1120</a>, CVE-2015-1076</a>, CVE-2015-1071</a>, CVE-2015-1081</a>, CVE-2015-1122</a>, CVE-2015-1155</a>, CVE-2014-1748</a>, CVE-2015-3752</a>, CVE-2015-5809</a>, CVE-2015-5928</a>, CVE-2015-3749</a>, CVE-2015-3659</a>, CVE-2015-3748</a>, CVE-2015-3743</a>, CVE-2015-3731</a>, CVE-2015-3745</a>, CVE-2015-5822</a>, CVE-2015-3658</a>, CVE-2015-3741</a>, CVE-2015-3727</a>, CVE-2015-5801</a>, CVE-2015-5788</a>, CVE-2015-3747</a>, CVE-2015-5794</a>, CVE-2015-1127</a>, CVE-2015-1153</a>, CVE-2015-1083</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.8 released! 2016-03-11T00:00:00+00:00 This is a bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.8 release?</h3> Limit the number of tiles according to the visible area. This was causing a huge memory consumption with some websites.</li> Fix flickering and rendering artifacts when entering accelerated compositing mode before the web view is realized.</li> Fix rendering of form controls and scrollbars with GTK+ >= 3.19.</li> Fix HTTP authentication dialog rendering when accelerated compositing mode is enabled.</li> Fix rendering artifacts when using a web view background color.</li> Fix a crash when creating a WebKitWebView without providing a WebKitWebContext.</li> Fix several crashes and rendering issues.</li> Security fixes: CVE-2016-1726</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2016-0002 2016-03-11T00:00:00+00:00 Date Reported: March 11, 2016 </li> Advisory ID: WSA-2016-0002 </li> CVE identifiers: CVE-2016-1723</a>, CVE-2016-1724</a>, CVE-2016-1725</a>, CVE-2016-1726</a>, CVE-2016-1727</a>, CVE-2016-1728</a>. </li> </ul> Several vulnerabilities were discovered on WebKitGTK+. CVE-2016-1723</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1725 and CVE-2016-1726.</li> </ul> </li> CVE-2016-1724</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1727.</li> </ul> </li> CVE-2016-1725</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1723 and CVE-2016-1726.</li> </ul> </li> CVE-2016-1726</a> Versions affected: WebKitGTK+ before 2.10.8.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1723 and CVE-2016-1725.</li> </ul> </li> CVE-2016-1727</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1724.</li> </ul> </li> CVE-2016-1728</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to an anonymous researcher coordinated via Joe Vennix.</li> The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height processing, which makes it easier for remote attackers to obtain sensitive browser-history information via a crafted web site.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.11.91 released! 2016-03-01T00:00:00+00:00 This is a development release leading toward 2.12 series. What's new in the WebKitGTK+ 2.11.91 release?</h3> Do not show stale contents after session restore.</li> Fix flickering and rendering artifacts when entering accelerated compositing mode before the web view is realized.</li> Fix several rendering issues and crashes.</li> Fix build with FTL enabled in FreeBSD.</li> Translation updates: Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.11.90 released! 2016-02-19T00:00:00+00:00 This is a development release leading toward 2.12 series. What's new in the WebKitGTK+ 2.11.90 release?</h3> Switch to use overlay scrollbars like all other GTK+ widgets and ensure the behavior is consistent with GTK+ too.</li> Limit the number of tiles according to the visible area. This was causing a huge memory consumption with some websites.</li> Fix toggle buttons rendering with GTK+ 3.19.</li> Fix HTTP authentication dialog rendering when accelerated compositing mode is enabled.</li> Use G_TYPE_ERROR instead of G_TYPE_POINTER for GError parameters of signals.</li> Fix several memory leaks.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.11.5 released! 2016-02-09T00:00:00+00:00 This is a development release leading toward 2.12 series. What's new in the WebKitGTK+ 2.11.5 release?</h3> Switch FTL to use B3 backend instead of LLVM.</li> Add support for windowless NPAPI plugins with no UI in non X11 platforms.</li> Fix a deadlock in the Web Process when JavaScript garbage collector was running for a web worker thread that made google maps to hang.</li> Fix a Web Process crash when quickly attempting many DnD operations.</li> Fix scrollbars rendering with older versions of GTK+.</li> Fix a crash when creating a WebKitWebView without providing a WebKitWebContext.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2016-0001 2016-02-01T00:00:00+00:00 Date Reported: February 01, 2016 </li> Advisory ID: WSA-2016-0001 </li> CVE identifiers: CVE-2015-7096</a>, CVE-2015-7098</a>. </li> </ul> Several vulnerabilities were discovered on WebKitGTK+. CVE-2015-7096</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.</li> </ul> </li> CVE-2015-7098</a> Versions affected: WebKitGTK+ before 2.10.5.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.10.7 released! 2016-01-29T00:00:00+00:00 This is a bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.7 release?</h3> Fix the build with GTK+ < 3.16.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.6 released! 2016-01-27T00:00:00+00:00 This is a bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.6 release?</h3> Fix a deadlock in the Web Process when JavaScript garbage collector was running for a web worker thread that made google maps to hang.</li> Fix media controls displaying without controls attribute.</li> Fix a Web Process crash when quickly attempting many DnD operations.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.5 released! 2016-01-20T00:00:00+00:00 This is a bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.5 release?</h3> Disable DNS prefetch when a proxy is configured.</li> Reduce the maximum simultaneous network connections to match other browsers.</li> Make WebKitWebView always propagate motion-notify-event signal.</li> Add a way to force accelerating compositing mode at runtime using an environment variable.</li> Fix input elements and scrollbars rendering with GTK+ 3.19.</li> Fix rendering of lines when using solid colors.</li> Fix UI process crashes related to not having a main resource response when the load is committed for pages restored from the history cache.</li> Fix a WebProcess crash when loading large contents with custom URI schemes API.</li> Fix a crash in the UI process when the WebView is destroyed while the screensaver DBus proxy is being created.</li> Fix WebProcess crashes due to BadDrawable X errors in accelerated compositing mode.</li> Fix crashes on PPC64 due to mprotect() on address not aligned to the page size.</li> Fix std::bad_function_call exception raised in dispatchDecidePolicyForNavigationAction.</li> Fix downloads of data URLs.</li> Fix runtime critical warnings when closing a page containing windowed plugins.</li> Fix several crashes and rendering issues.</li> Translation updates: French, German, Italian, Turkish.</li> Security fixes: CVE-2015-7096</a>, CVE-2015-7098</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.11.4 released! 2016-01-20T00:00:00+00:00 This is a development release leading toward 2.12 series. What's new in the WebKitGTK+ 2.11.4 release?</h3> Prefer to link to LLVM shared libraries when building with FTL enabled.</li> Fix runtime errors when serializing/deserializing session state.</li> Fix critical warnings when loading a URL after a session restore.</li> Fix the build with GTK+ < 3.14.</li> Fix the build with video support disabled.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.11.3 released! 2016-01-13T00:00:00+00:00 This is a development release leading toward 2.12 series. What's new in the WebKitGTK+ 2.11.3 release?</h3> NetworkProcess is now used unconditionally. The shared secondary process model is now the same as using the multiple process model and setting a process limit of 1.</li> Disable DNS prefetch when a proxy is configured.</li> Reduce the maximum simultaneous network connections to match other browsers.</li> Extend notifications API to notify WebKit when a notification is clicked by the user.</li> Add new API to save and restore a WebView session.</li> Add Web Extensions API to be notified about console messages.</li> Add WebKitURIRequest API to get the HTTP method.</li> Add API to handle beforeunload events.</li> Make WebKitWebView always propagate motion-notify-event signal.</li> Add a way to force accelerating compositing mode at runtime using an environment variable.</li> Fix input elements and scrollbars rendering with GTK+ 3.19.</li> Fix a crash in the UI process when the WebView is destroyed while the screensaver DBus proxy is being created.</li> Fix a WebProcess crash when loading large contents with custom URI schemes API.</li> Fix UI process crashes related to not having a main resource response when the load is committed for pages restored from the history cache.</li> Translation updates: French, German, Turkish</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2015-0002 2015-12-28T00:00:00+00:00 Date Reported: December 28, 2015 </li> Advisory ID: WSA-2015-0002 </li> CVE identifiers: CVE-2013-6663</a>, CVE-2014-1748</a>, CVE-2014-3192</a>, CVE-2014-4409</a>, CVE-2014-4410</a>, CVE-2014-4411</a>, CVE-2014-4412</a>, CVE-2014-4413</a>, CVE-2014-4414</a>, CVE-2014-4452</a>, CVE-2014-4459</a>, CVE-2014-4465</a>, CVE-2014-4466</a>, CVE-2014-4468</a>, CVE-2014-4469</a>, CVE-2014-4470</a>, CVE-2014-4471</a>, CVE-2014-4472</a>, CVE-2014-4473</a>, CVE-2014-4474</a>, CVE-2014-4475</a>, CVE-2014-4476</a>, CVE-2014-4477</a>, CVE-2014-4479</a>, CVE-2015-1068</a>, CVE-2015-1069</a>, CVE-2015-1070</a>, CVE-2015-1071</a>, CVE-2015-1072</a>, CVE-2015-1073</a>, CVE-2015-1074</a>, CVE-2015-1075</a>, CVE-2015-1076</a>, CVE-2015-1077</a>, CVE-2015-1080</a>, CVE-2015-1081</a>, CVE-2015-1082</a>, CVE-2015-1083</a>, CVE-2015-1084</a>, CVE-2015-1119</a>, CVE-2015-1120</a>, CVE-2015-1121</a>, CVE-2015-1122</a>, CVE-2015-1124</a>, CVE-2015-1126</a>, CVE-2015-1127</a>, CVE-2015-1152</a>, CVE-2015-1153</a>, CVE-2015-1154</a>, CVE-2015-1155</a>, CVE-2015-1156</a>, CVE-2015-2330</a>, CVE-2015-3658</a>, CVE-2015-3659</a>, CVE-2015-3660</a>, CVE-2015-3727</a>, CVE-2015-3730</a>, CVE-2015-3731</a>, CVE-2015-3732</a>, CVE-2015-3733</a>, CVE-2015-3734</a>, CVE-2015-3735</a>, CVE-2015-3736</a>, CVE-2015-3737</a>, CVE-2015-3738</a>, CVE-2015-3739</a>, CVE-2015-3740</a>, CVE-2015-3741</a>, CVE-2015-3742</a>, CVE-2015-3743</a>, CVE-2015-3744</a>, CVE-2015-3745</a>, CVE-2015-3746</a>, CVE-2015-3747</a>, CVE-2015-3748</a>, CVE-2015-3749</a>, CVE-2015-3750</a>, CVE-2015-3751</a>, CVE-2015-3752</a>, CVE-2015-3753</a>, CVE-2015-3754</a>, CVE-2015-3755</a>, CVE-2015-5788</a>, CVE-2015-5789</a>, CVE-2015-5790</a>, CVE-2015-5791</a>, CVE-2015-5792</a>, CVE-2015-5793</a>, CVE-2015-5794</a>, CVE-2015-5795</a>, CVE-2015-5797</a>, CVE-2015-5798</a>, CVE-2015-5799</a>, CVE-2015-5800</a>, CVE-2015-5801</a>, CVE-2015-5802</a>, CVE-2015-5803</a>, CVE-2015-5804</a>, CVE-2015-5805</a>, CVE-2015-5806</a>, CVE-2015-5807</a>, CVE-2015-5809</a>, CVE-2015-5810</a>, CVE-2015-5811</a>, CVE-2015-5812</a>, CVE-2015-5813</a>, CVE-2015-5814</a>, CVE-2015-5815</a>, CVE-2015-5816</a>, CVE-2015-5817</a>, CVE-2015-5818</a>, CVE-2015-5819</a>, CVE-2015-5822</a>, CVE-2015-5823</a>, CVE-2015-5825</a>, CVE-2015-5826</a>, CVE-2015-5827</a>, CVE-2015-5828</a>, CVE-2015-5928</a>, CVE-2015-5929</a>, CVE-2015-5930</a>, CVE-2015-5931</a>, CVE-2015-7002</a>, CVE-2015-7012</a>, CVE-2015-7013</a>, CVE-2015-7014</a>, CVE-2015-7048</a>, CVE-2015-7095</a>, CVE-2015-7097</a>, CVE-2015-7099</a>, CVE-2015-7100</a>, CVE-2015-7102</a>, CVE-2015-7103</a>, CVE-2015-7104</a>. </li> </ul> Several vulnerabilities were discovered on WebKitGTK+. CVE-2013-6663</a> Versions affected: WebKitGTK+ before 2.4.0.</li> Credit to Atte Kettunen of OUSPG.</li> Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view.</li> </ul> </li> CVE-2014-1748</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Jordan Milne.</li> The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.</li> </ul> </li> CVE-2014-3192</a> Versions affected: WebKitGTK+ before 2.6.3.</li> Credit to cloudfuzzer.</li> Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.</li> </ul> </li> CVE-2014-4409</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Yosuke Hasegawa (NetAgent Co., Led.).</li> WebKit in Apple iOS before 8 makes it easier for remote attackers to track users during private browsing via a crafted web site that reads HTML5 application-cache data that had been stored during normal browsing.</li> </ul> </li> CVE-2014-4410</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Eric Seidel of Google.</li> WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and APPLE-SA-2014-09-17-2.</li> </ul> </li> CVE-2014-4411</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and APPLE-SA-2014-09-17-2.</li> </ul> </li> CVE-2014-4412</a> Versions affected: WebKitGTK+ before 2.4.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and APPLE-SA-2014-09-17-2.</li> </ul> </li> CVE-2014-4413</a> Versions affected: WebKitGTK+ before 2.4.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and APPLE-SA-2014-09-17-2.</li> </ul> </li> CVE-2014-4414</a> Versions affected: WebKitGTK+ before 2.4.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and APPLE-SA-2014-09-17-2.</li> </ul> </li> CVE-2014-4452</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to unknown.</li> WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4462.</li> </ul> </li> CVE-2014-4459</a> Versions affected: WebKitGTK+ before 2.6.2.</li> Credit to unknown.</li> Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attackers to execute arbitrary code via crafted page objects in an HTML document.</li> </ul> </li> CVE-2014-4465</a> Versions affected: WebKitGTK+ before 2.6.2.</li> Credit to Rennie deGraaf of iSEC Partners.</li> WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element.</li> </ul> </li> CVE-2014-4466</a> Versions affected: WebKitGTK+ before 2.6.2.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4468</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4469</a> Versions affected: WebKitGTK+ before 2.6.4.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4470</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4471</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4472</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4473</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4474</a> Versions affected: WebKitGTK+ before 2.6.2.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4475</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.</li> </ul> </li> CVE-2014-4476</a> Versions affected: WebKitGTK+ before 2.6.2.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4477 and CVE-2014-4479.</li> </ul> </li> CVE-2014-4477</a> Versions affected: WebKitGTK+ before 2.6.4.</li> Credit to lokihardt@ASRT working with HP’s Zero Day Initiative.</li> WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4476 and CVE-2014-4479.</li> </ul> </li> CVE-2014-4479</a> Versions affected: WebKitGTK+ before 2.6.4.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4476 and CVE-2014-4477.</li> </ul> </li> CVE-2015-1068</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1069</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1070</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1071</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1072</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to unknown.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1073</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1074</a> Versions affected: WebKitGTK+ before 2.6.4.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1075</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1076</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to unknown.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1077</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1080</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1081</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1082</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1083</a> Versions affected: WebKitGTK+ before 2.6.4.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.</li> </ul> </li> CVE-2015-1084</a> Versions affected: WebKitGTK+ before 2.6.1.</li> Credit to Apple.</li> The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.</li> </ul> </li> CVE-2015-1119</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Renata Hodovan of University of Szeged / Samsung Electronics.</li> WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE- SA-2015-04-08-4.</li> </ul> </li> CVE-2015-1120</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE- SA-2015-04-08-4.</li> </ul> </li> CVE-2015-1121</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE- SA-2015-04-08-4.</li> </ul> </li> CVE-2015-1122</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE- SA-2015-04-08-4.</li> </ul> </li> CVE-2015-1124</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE- SA-2015-04-08-4.</li> </ul> </li> CVE-2015-1126</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Jouko Pynnonen of Klikki Oy.</li> WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.</li> </ul> </li> CVE-2015-1127</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Tyler C (2.6.5).</li> The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history into an index, which might allow local users to obtain sensitive information by reading index entries.</li> </ul> </li> CVE-2015-1152</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1153 and CVE-2015-1154.</li> </ul> </li> CVE-2015-1153</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple (2.6.5).</li> WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1154.</li> </ul> </li> CVE-2015-1154</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple (2.6.5).</li> WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1153.</li> </ul> </li> CVE-2015-1155</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Joe Vennix of Rapid7 Inc. working with HP's Zero Day Initiative.</li> The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.</li> </ul> </li> CVE-2015-1156</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Zachary Durber of Moodle.</li> The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.</li> </ul> </li> CVE-2015-2330</a> Versions affected: WebKitGTK+ before 2.6.6.</li> Credit to Ross Lagerwall.</li> Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.</li> </ul> </li> CVE-2015-3658</a> Versions affected: WebKitGTK+ before 2.8.1.</li> Credit to Brad Hill of Facebook.</li> The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.</li> </ul> </li> CVE-2015-3659</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Peter Rutenbar working with HP's Zero Day Initiative.</li> The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.</li> </ul> </li> CVE-2015-3660</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.</li> </ul> </li> CVE-2015-3727</a> Versions affected: WebKitGTK+ before 2.8.1.</li> Credit to Peter Rutenbar working with HP's Zero Day Initiative.</li> WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access an arbitrary web site's database via a crafted web site.</li> </ul> </li> CVE-2015-3730</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3731</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3732</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3733</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3734</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3735</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3736</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3737</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3738</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3739</a> Versions affected: WebKitGTK+ before 2.8.1.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3740</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3741</a> Versions affected: WebKitGTK+ before 2.8.1.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3742</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3743</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3744</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3745</a> Versions affected: WebKitGTK+ before 2.8.1.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3746</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3747</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3748</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3749</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE- SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.</li> </ul> </li> CVE-2015-3750</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Muneaki Nishimura (nishimunea).</li> WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client- server data stream.</li> </ul> </li> CVE-2015-3751</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Muneaki Nishimura (nishimunea).</li> WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element.</li> </ul> </li> CVE-2015-3752</a> Versions affected: WebKitGTK+ before 2.8.4.</li> Credit to Muneaki Nishimura (nishimunea).</li> The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross- origin request or (2) a private-browsing request.</li> </ul> </li> CVE-2015-3753</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Antonio Sanso and Damien Antipa of Adobe.</li> WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.</li> </ul> </li> CVE-2015-3754</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Dongsung Kim (@kid1ng).</li> The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.</li> </ul> </li> CVE-2015-3755</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to xisigr of Tencent's Xuanwu Lab.</li> WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.</li> </ul> </li> CVE-2015-5788</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element.</li> </ul> </li> CVE-2015-5789</a> Versions affected: WebKitGTK+ before 2.6.1.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5790</a> Versions affected: WebKitGTK+ before 2.6.2.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5791</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5792</a> Versions affected: WebKitGTK+ before 2.4.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5793</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5794</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5795</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5797</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5798</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple iTunes before 12.3, allows man-in-the- middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5799</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple (2.6.5).</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5800</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple (2.6.5).</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5801</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5802</a> Versions affected: WebKitGTK+ before 2.6.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5803</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5804</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5805</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to unknown.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5806</a> Versions affected: WebKitGTK+ before 2.8.3.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5807</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5809</a> Versions affected: WebKitGTK+ before 2.8.4.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5810</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5811</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5812</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5813</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5814</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5815</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iTunes before 12.3, allows man-in-the- middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5816</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5817</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5818</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5819</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5822</a> Versions affected: WebKitGTK+ before 2.8.1.</li> Credit to Mark S. Miller of Google.</li> WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5823</a> Versions affected: WebKitGTK+ before 2.8.0.</li> Credit to Apple.</li> WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.</li> </ul> </li> CVE-2015-5825</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Yossi Oren et al. of Columbia University's Network Security Lab.</li> WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.</li> </ul> </li> CVE-2015-5826</a> Versions affected: WebKitGTK+ before 2.6.5.</li> Credit to filedescriptior, Chris Evans.</li> WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.</li> </ul> </li> CVE-2015-5827</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Gildas.</li> WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.</li> </ul> </li> CVE-2015-5828</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Lorenzo Fontana.</li> The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.</li> </ul> </li> CVE-2015-5928</a> Versions affected: WebKitGTK+ before 2.8.4.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.</li> </ul> </li> CVE-2015-5929</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.</li> </ul> </li> CVE-2015-5930</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.</li> </ul> </li> CVE-2015-5931</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to unknown.</li> WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.</li> </ul> </li> CVE-2015-7002</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.</li> </ul> </li> CVE-2015-7012</a> Versions affected: WebKitGTK+ before 2.8.4.</li> Credit to Apple.</li> WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.</li> </ul> </li> CVE-2015-7013</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.</li> </ul> </li> CVE-2015-7014</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to unknown.</li> WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.</li> </ul> </li> CVE-2015-7048</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.</li> </ul> </li> CVE-2015-7095</a> Versions affected: WebKitGTK+ before 2.10.2.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.</li> </ul> </li> CVE-2015-7097</a> Versions affected: WebKitGTK+ before 2.10.3.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.</li> </ul> </li> CVE-2015-7099</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.</li> </ul> </li> CVE-2015-7100</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.</li> </ul> </li> CVE-2015-7102</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, and CVE-2015-7103.</li> </ul> </li> CVE-2015-7103</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, and CVE-2015-7102.</li> </ul> </li> CVE-2015-7104</a> Versions affected: WebKitGTK+ before 2.10.0.</li> Credit to Apple.</li> WebKit in Apple Safari before 9.0.2 and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</li> </ul> </li> </ul> We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.11.2 released! 2015-11-23T00:00:00+00:00 This is a development release leading toward 2.12 series. What's new in the WebKitGTK+ 2.11.2 release?</h3> Enable FTL by default in JavaScriptCore for x86_64.</li> Improved media backend performance by better handling glib main loop sources.</li> Fix rendering of lines when using solid colors.</li> Fix web process crashes due to BadDrawable X errors in accelerated compositing mode.</li> Translation updates: Italian.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.4 released! 2015-11-11T00:00:00+00:00 This is a bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.4 release?</h3> Fixed dashed and dotted border painting.</li> Properly cancel navigation policy checks.</li> Several crashes fixed when running editor commands.</li> Fix several crashes due to assertions in Debug builds.</li> Fix the build on Mac OSX and bring back the Quartz target.</li> Fix the build on glibc-based BSD systems.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.11.1 released! 2015-11-03T00:00:00+00:00 This is the first development release leading toward 2.12 series. What's new in the WebKitGTK+ 2.11.1 release?</h3> Improved general performance by better handling glib main loop sources.</li> Add autocleanups support to GObjects exposed in public API.</li> Fixed dashed and dotted border painting.</li> Upload the accelerated canvas as a texture by copying via GPU directly.</li> Popup menus no longer use a nested main loop.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.3 released! 2015-10-26T00:00:00+00:00 This is a bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.3 release?</h3> Fix graphics artifacts when entering/leaving Accelerated Compositing mode.</li> Honour 'forwards' fill-mode in Multiple-keyframe and delayed instantaneous animations.</li> Fix runtime warning when the inspector is closed.</li> Fix the build with GTK+2 plugin process disabled.</li> Gracefully handle errors when sending/receiving IPC messages data on connection close.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.2 released! 2015-10-15T00:00:00+00:00 This is a bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.2 release?</h3> Fix a regression introduced in 2.10.1 that disabled accelerated compositing.</li> Fix build with cmake 3.4.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.1 released! 2015-10-14T00:00:00+00:00 This is the first bug fix release in the stable 2.10 series. What's new in the WebKitGTK+ 2.10.1 release?</h3> Fix rendering of accelerated content in HiDPI screens.</li> Fix several media controls rendering issues.</li> Fix rendering of progress element with recent versions of GTK+.</li> Add and update some web inspector icons.</li> Correctly handle websites sending an invalid auth header.</li> Fix a crash when creating the UI process backing store in Wayland.</li> Fix the build with spellchecker disabled.</li> Fix the build with touch events disabled.</li> Fix the build with OpenGL disabled.</li> Several build fixes on Mac OSX.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.10.0 released! 2015-09-21T00:00:00+00:00 This is the first stable release in the 2.10 series. Highlights of the WebKitGTK+ 2.10.0 release</h3> New HTTP disk cache for the Network Process.</li> IndexedDB support.</li> New Web Inspector UI.</li> Automatic ScreenServer inhibition when playing fullscreen videos.</li> Improved font matching algorithm.</li> Initial Editor API.</li> Performance improvements.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.10 see the NEWS file that is included in the tarball, or see: http://blogs.igalia.com/carlosgc/2015/09/21/webkitgtk-2-10/</a> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.9.92 released! 2015-09-16T00:00:00+00:00 This is a development release leading toward 2.10 series. What's new in the WebKitGTK+ 2.9.92 release?</h3> Data URLs are now decoded in the Web Process instead of the Network Process.</li> Fix Web Process crash recovery.</li> Fix a crash when sqlite3_initialize() is called from multiple threads.</li> Fix the volume bar in media controls.</li> Fix JavaScriptCore build with GCC 5.</li> Fix the build when accelerated 2D canvas is enabled but cairo was built without GLX.</li> Fix everal memory leaks.</li> Translation updates: Bulgarian, Gujarati, Polish, Slovenian, Spanish, Tamil, Turkish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.9.91 released! 2015-08-26T00:00:00+00:00 This is a development release leading toward 2.10 series. What's new in the WebKitGTK+ 2.9.91 release?</h3> Fix performance regression introduced in previous release when scaling images.</li> Fix runtime critical warning when there are missing media plugins.</li> Fix the build on systems with GTK+ compiled with an old version of wayland.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.9.90 released! 2015-08-14T00:00:00+00:00 This is a development release leading toward 2.10 series. What's new in the WebKitGTK+ 2.9.90 release?</h3> Add API to request permission before showing PackageKit codec installation notifications.</li> Fix a crash closing a page when a context menu is open.</li> Fix DNS prefetch when using the network process.</li> Improve image quality when using newer versions of cairo/pixman.</li> Fix a crash when the web view is destroyed while the screensaver DBus proxy is being created.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.8.5 released! 2015-08-06T00:00:00+00:00 This is a bug fix release in the stable 2.8 series. What's new in the WebKitGTK+ 2.8.5 release?</h3> Fix the window size reported when the web view isn't realized yet. This fixes the layout of some websites when opening new tabs in the browser and anchor links when opened in new tabs too.</li> Prevent clipboard contents from being lost when web process finishes.</li> Always allow font matching for strong aliases.</li> Move GStreamer missing plugins installer to the UI process.</li> Fix a crash when spell checker returns no guesses.</li> Fix a crash when SoupSession is destroyed in exit handler.</li> Fix a crash closing a page when default context menu is open.</li> Several crashes and rendering issues fixed.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.9.5 released! 2015-08-03T00:00:00+00:00 This is a development release leading toward 2.10 series. What's new in the WebKitGTK+ 2.9.5 release?</h3> Add API to set the maximum number of web processes per WebKitWebContext.</li> Add API to allow executing editing commands that require an argument.</li> Prevent clipboard contents from being lost when web process finishes.</li> Always allow font matching for strong aliases</li> Move GStreamer missing plugins installer to the UI process.</li> Fix empty space in popup menus when first item is selected.</li> Fix a crash when SoupSession is destroyed in exit handler.</li> Disable NPAPI plugins when running on Wayland.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.9.4 released! 2015-07-22T00:00:00+00:00 This is a development release leading toward 2.10 series. What's new in the WebKitGTK+ 2.9.4 release?</h3> Fix the window size reported when the web view isn't realized yet. This fixes the layout of some websites when opening new tabs in the browser and anchor links when opened in new tabs too.</li> Add API to be notified about editor state changes.</li> Add selection-changed signal to the Web Extensions API.</li> Add initial WebKitWebsiteDataManager API for process configuration options.</li> Make WebSQL work by using a default quota instead of always failing in openDatabase with DOM Exception 18.</li> Correctly restore accelerated compositing after a WebProcess crash.</li> Only enable the input methods filter when there's an editable element focused.</li> Fix a crash on memory allocation using bmalloc on 32bit systems.</li> Allow to build with X11 and Wayland targets at the same time.</li> Fix a crash when spell checker returns no guesses.</li> Update and optimize some of the web inspector icons.</li> Translation updates: Swedish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.8.4 released! 2015-07-08T00:00:00+00:00 This is a bug fix release in the stable 2.8 series. What's new in the WebKitGTK+ 2.8.4 release?</h3> Make WebSQL work by using a default quota instead of always failing in openDatabase with DOM Exception 18.</li> Improve detection and usage of GL/GLES/EGL libraries.</li> Fix a crash on memory allocation using bmalloc on 32bit systems.</li> Fix DOCUMENT_VIEWER cache model to actually disable the memory cache.</li> Fix a WebProcess crash after too many redirect error when there's an active NPAPI plugin.</li> Fix a WebProcess crash when gtk-font-name setting is empty.</li> Ensure Math.abs() doesn't return negative.</li> Correctly restore accelerated compositing after a WebProcess crash.</li> Respect X-Frame-Options headers when loading from application cache.</li> Several crashes and rendering issues fixed.</li> Fix the MIPS N64 detection.</li> Fix several memory leaks.</li> Translation updates: Catalan.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.9.3 released! 2015-06-23T00:00:00+00:00 This is a development release leading toward 2.10 series. What's new in the WebKitGTK+ 2.9.3 release?</h3> Inhibit screen saver when playing full screen video.</li> Fix DOCUMENT_VIEWER cache model to actually disable the memory cache.</li> Fix a regression that prevented the WebKitWebView::context-menu signal from being emitted.</li> Update web inspector icon so Rendering Frames timeline distinguish between layout and painting.</li> Ensure fragment identifier part of URI is not removed for custom URI scheme requests.</li> Improve performance of keyboard events handling.</li> Expose element tag name as an object attribute to accessibility.</li> Fix the build with Wayland target enabled.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.9.2 released! 2015-05-27T00:00:00+00:00 This is a development release leading toward 2.10 series. What's new in the WebKitGTK+ 2.9.2 release?</h3> Add IndexedDB support using a dedicated database process.</li> Add construct property to WebKitWebContext to set the IndexedDB database directory.</li> Add allow-file-access-from-file-urls to WebKitSettings.</li> Improve network process disk cache performance by mapping cached resources in the web process instead of sending the resources data via IPC.</li> Prevent WorkQueue objects from being leaked and ensure its worker thread always exits.</li> webkit_dom_html_element_get_children() has been deprecated in favor of webkit_dom_element_get_children() to match the DOM spec.</li> ARIA menu items no longer have anonymous block children.</li> Map pre element to ATK_ROLE_SECTION instead of ATK_ROLE_PANEL.</li> Always include rows in the tree of accessible tables.</li> Fix the build with Netscape plugins disabled.</li> Fix XPixmaps leaked by GLContext when using EGL on X11.</li> Translation updates: Catalan.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.9 released! 2015-05-20T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.9 release?</h3> Check TLS errors as soon as they are set in the SoupMessage to prevent any data from being sent to the server in case of invalid certificate.</li> Clear the GObject DOM bindings internal cache when frames are destroyed or web view contents are updated.</li> Add HighDPI support for non-accelerated compositing contents.</li> Fix some transfer annotations used in GObject DOM bindings.</li> Use latin1 instead of UTF-8 for HTTP header values.</li> Fix synchronous loads when maximum connection limits are reached.</li> Fix a crash ScrollView::contentsToWindow() when GtkPluginWidget doesn't have a parent.</li> Fix a memory leak in webkit_web_policy_decision_new.</li> Fix g_closure_unref runtime warning.</li> Fix a crash due to empty drag image during drag and drop.</li> Fix rendering of scrollbars with GTK+ >= 3.16.</li> Fix the build on mingw32/msys.</li> Fix the build with WebKit2 disabled.</li> Fix the build with accelerated compositing disabled.</li> Fix clang version check in configure.</li> Fix the build with recent versions of GLib that have GMutexLocker.</li> Fix the build for Linux/MIPS64EL.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.8.3 released! 2015-05-15T00:00:00+00:00 This is a bug fix release in the stable 2.8 series. What's new in the WebKitGTK+ 2.8.3 release?</h3> Fixed a regression introduced in 2.8.2 that broke downloads when using the network process.</li> Fix the build with Netscape plugins disabled.</li> Fix XPixamps leaked by GLContext when using EGL on X11.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.8.2 released! 2015-05-12T00:00:00+00:00 This is a bug fix release in the stable 2.8 series. What's new in the WebKitGTK+ 2.8.2 release?</h3> Fix network redirection to a non HTTP destination.</li> Use a webkit subdirectory for the disk cache to avoid conflicts with other files in the cache directory when the disk cache is cleaned up.</li> Do not preserve the Origin header on on cross-origin redirects.</li> Prevent WorkQueue objects from being leaked and ensure its worker thread always exits.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.9.1 released! 2015-05-07T00:00:00+00:00 This is the first development release leading toward 2.10 series. What's new in the WebKitGTK+ 2.9.1 release?</h3> New disk cache implementation when using the network process.</li> Web inspector UI has been redesigned.</li> Add support for automatic hyphenation using libhyphen when it's available.</li> Fix network redirection to a non HTTP destination.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.8.1 released! 2015-04-14T00:00:00+00:00 This is the first bug fix release in the stable 2.8 series. What's new in the WebKitGTK+ 2.8.1 release?</h3> Handle keep-alive connections in GStreamer HTTP source element.</li> Fix a crash in DOMObjectCache when a wrapped object owned by the cache is unreffed by the user.</li> Fix rendering of drag and drop icon.</li> Fix the build with REDIRECTED_XCOMPOSITE_WINDOW disabled in X11 platform.</li> Fix the build with Wayland target enabled.</li> Fix the build for HPPA.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.6.6 released! 2015-04-07T00:00:00+00:00 This is a bug fix release in the stable 2.6 series. What's new in the WebKitGTK+ 2.6.6 release?</h3> Check TLS errors as soon as they are set in the SoupMessage to prevent any data from being sent to the server in case of invalid certificate.</li> Fix synchronous loads when maximum connection limits are reached.</li> Fix web timing calculations when loading resources from the disk cache.</li> Ensure WebKitFrame objects are released when the frame is destroyed.</li> Fix some transfer annotations used in GObject DOM bindings.</li> Clear the GObject DOM bindings internal cache when frames are destroyed or web view contents are updated.</li> Fix a crash viewing http://www.last.fm/.</li> Fix a crash due to empty drag image during drag and drop.</li> Fix rendering of drag and drop icon.</li> Resize the accelerating compositing window to a minimum size again after leaving accelerated compositing mode to save memory.</li> Fix a crash when loading a local file with webkit_web_view_load_alternate_html.</li> Fix rendering of scrollbars with GTK+ >= 3.16.</li> Fix the build with older versions of GStreamer.</li> Fix the build with CMake 3.2.</li> Fix the build for Linux/MIPS64EL.</li> Fix the build for HPPA.</li> Fix the build with recent versions of GLib that have GMutexLocker.</li> Fix the gtk-doc generation to appear in DevHelp.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.8.0 released! 2015-03-23T00:00:00+00:00 This is the first stable release in the 2.8 series. Highlights of the WebKitGTK+ 2.8.0 release</h3> Initial gestures support.</li> HTML5 notifications.</li> User script messages.</li> HTML5 color input.</li> APNG support.</li> Performance improvements.</li> Playing audio notification signal.</li> Web view background colors.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.8 see the NEWS file that is included in the tarball, or see: http://blogs.igalia.com/carlosgc/2015/03/23/webkitgtk-2-8-0/</a> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.7.92 released! 2015-03-17T00:00:00+00:00 This is a development release leading toward 2.8 series. What's new in the WebKitGTK+ 2.7.92 release?</h3> Add APNG support.</li> Disable RC4 support in networking backend.</li> Add a configure option to build with OpenGL ES 2.</li> Add an option to enable MiniBrowser for non developer builds and always install it.</li> Check TLS errors as soon as they are set in the SoupMessage to prevent any data from being sent to the server in case of invalid certificate.</li> Make WebKitWebView always hold a reference on WebKitWebContext now that it's possible to create new web contexts.</li> Fix a crash when entering accelerated compositing mode before the WebView is realized.</li> Fix some transfer annotations used in GObject DOM bindings.</li> Fix GObject DOM objects leaked when the web view contents are updated.</li> Fix a crash viewing http://www.last.fm/.</li> Fix an infinite loop in ARM Linux when parallel GC is enabled it again.</li> Fix the build with older versions of GStreamer.</li> Fix the build when NEON_INTRINSICS is enabled.</li> Fix the build with video enabled but WebAudio disabled.</li> Translation updates: Hebrew, Polish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.7.91 released! 2015-03-03T00:00:00+00:00 This is a development release leading toward 2.8 series. What's new in the WebKitGTK+ 2.7.91 release?</h3> Enable concurrent JIT.</li> Add support for ARIA 1.1 'switch' and 'searchbox' roles.</li> Fix synchronous loads when maximum connection limits are reached.</li> Fix web timing calculations when loading resources from the disk cache.</li> Fix a crash when loading a local file with webkit_web_view_load_alternate_html.</li> Fix a WebProcess crash when entering accelerating compositing mode before the WebView is realized.</li> Improve the appearance of fonts loaded via @font-face.</li> Fix undefined symbol issue when loading web extensions.</li> Build bmalloc as a static library.</li> Fix the build with CMake 3.2.</li> Fix the C-Loop LLInt build.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.7.90 released! 2015-02-17T00:00:00+00:00 This is a development release leading toward 2.8 series. What's new in the WebKitGTK+ 2.7.90 release?</h3> Use the new memory allocator bmalloc instead of TCMalloc which drastically improves the overall performance.</li> Remove WebKitWebView::close-notification signal and add WebKitNotification::closed instead.</li> Implement support for new AtkRole types for MathML.</li> Add support for input color type.</li> Add API to allow overriding the default color chooser implementation.</li> Resize the accelerating compositing window to a minimum size again after leaving accelerated compositing mode to save memory.</li> Ensure WebKitFrame objects are released when the frame is destroyed.</li> Clear the GObject DOM bindings internal cache when frames are destroyed.</li> Implement page overlays to bring back the inspector element highlighting.</li> Fix startup runtime critical warnings when using the network process.</li> Fix the build with recent versions of GLib that have GMutexLocker.</li> Fix the gtk-doc generation to appear in DevHelp.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ Security Advisory WSA-2015-0001 2015-01-26T00:00:00+00:00 Date Reported: January 26, 2015 </li> Advisory ID: WSA-2015-0001 </li> Affected versions: 2.4 series before 2.4.1, 2.4.2 and 2.4.8.</li> </ul> </li> CVE identifiers: CVE-2013-2871</a>, CVE-2014-1292</a>, CVE-2014-1298</a>, CVE-2014-1299</a>, CVE-2014-1300</a>, CVE-2014-1303</a>, CVE-2014-1304</a>, CVE-2014-1305</a>, CVE-2014-1307</a>, CVE-2014-1308</a>, CVE-2014-1309</a>, CVE-2014-1311</a>, CVE-2014-1313</a>, CVE-2014-1713</a>, CVE-2014-1297</a>, CVE-2013-2875</a>, CVE-2013-2927</a>, CVE-2014-1323</a>, CVE-2014-1326</a>, CVE-2014-1329</a>, CVE-2014-1330</a>, CVE-2014-1331</a>, CVE-2014-1333</a>, CVE-2014-1334</a>, CVE-2014-1335</a>, CVE-2014-1336</a>, CVE-2014-1337</a>, CVE-2014-1338</a>, CVE-2014-1339</a>, CVE-2014-1341</a>, CVE-2014-1342</a>, CVE-2014-1343</a>, CVE-2014-1731</a>, CVE-2014-1346</a>, CVE-2014-1344</a>, CVE-2014-1384</a>, CVE-2014-1385</a>, CVE-2014-1387</a>, CVE-2014-1388</a>, CVE-2014-1389</a>, CVE-2014-1390</a>. </li> </ul> Several vulnerabilities were discovered on the 2.4 stable series of WebKitGTK+. CVE-2013-2871</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to miaubiz.</li> Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of input.</li> </ul> </li> CVE-2014-1292</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294.</li> </ul> </li> CVE-2014-1298</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1299</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Google Chrome Security Team, Apple, Renata Hodovan of University of Szeged / Samsung Electronics.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1300</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Ian Beer of Google Project Zero working with HP's Zero Day Initiative.</li> Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014.</li> </ul> </li> CVE-2014-1303</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to KeenTeam working with HP's Zero Day Initiative.</li> Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.</li> </ul> </li> CVE-2014-1304</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1305</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1307</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1308</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1309</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to cloudfuzzer.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1311</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1313</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.</li> </ul> </li> CVE-2014-1713</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to VUPEN working with HP's Zero Day Initiative.</li> Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value.</li> </ul> </li> CVE-2014-1297</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.1.</li> Credit to Ian Beer of Google Project Zero.</li> WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access.</li> </ul> </li> CVE-2013-2875</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to miaubiz.</li> core/rendering/svg/SVGInlineTextBox.cpp in the SVG implementation in Blink, as used in Google Chrome before 28.0.1500.71, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.</li> </ul> </li> CVE-2013-2927</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to cloudfuzzer.</li> Use-after-free vulnerability in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink, as used in Google Chrome before 30.0.1599.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to submission for FORM elements.</li> </ul> </li> CVE-2014-1323</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to banty.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1326</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1329</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1330</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1331</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to cloudfuzzer.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1333</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1334</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1335</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1336</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1337</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1338</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1339</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Atte Kettunen of OUSPG.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1341</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1342</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1343</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1731</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to an anonymous member of the Blink development community.</li> core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements.</li> </ul> </li> CVE-2014-1346</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.2.</li> Credit to Erling Ellingsen of Facebook.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.</li> </ul> </li> CVE-2014-1344</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.8.</li> Credit to Ian Beer of Google Project Zero.</li> WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.</li> </ul> </li> CVE-2014-1384</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.8.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.</li> </ul> </li> CVE-2014-1385</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.8.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.</li> </ul> </li> CVE-2014-1387</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.8.</li> Credit to Google Chrome Security Team.</li> WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.</li> </ul> </li> CVE-2014-1388</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.8.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.</li> </ul> </li> CVE-2014-1389</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.8.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.</li> </ul> </li> CVE-2014-1390</a> Versions affected: WebKitGTK+ 2.4.X before 2.4.8.</li> Credit to Apple.</li> WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.</li> </ul> </li> </ul> For the 2.4 series, these problems have been fixed in release 2.4.8. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html</a> WebKitGTK+ 2.7.4 released! 2015-01-20T00:00:00+00:00 This is a development release leading toward 2.8 series. What's new in the WebKitGTK+ 2.7.4 release?</h3> Add API to change the WebKitWebView background color.</li> Add an option to create WebKitWebView snapshots with transparent background.</li> Add API to make the WebKitWebView editable.</li> Add is-playing-audio property to WebKitWebView.</li> Do not resize the accelerating compositing window to the web size until accelerated compositing mode is activated.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.6.5 released! 2015-01-15T00:00:00+00:00 This is a bug fix release in the stable 2.6 series. What's new in the WebKitGTK+ 2.6.5 release?</h3> Fix issue that caused some text to be inserted when trying to delete a word from the Twitter message box.</li> GObject DOM bindings API now correctly returns NULL intead of empty strings to be able to differentiate between not present and present but empty.</li> Do not resize the accelerating compositing window to the web size until accelerated compositing mode is activated.</li> Use latin1 instead of UTF-8 for HTTP header values.</li> Add SCHEDULING query support to HTTP media source element.</li> Add application/x-mpegurl and video/flv to the list of supported mimetypes.</li> Update NavigationItemProbes inspector icon.</li> Fix the build with recent GStreamer.</li> Fix the build on FreeBSD.</li> Fix build on OS X.</li> Fix the build on powerpc 32 bits.</li> Fixed several crashes in WebCore and JavaScriptCore.</li> Translation updates: Assamese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.8 released! 2015-01-07T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.8 release?</h3> Fix SSL connection issues with some websites after the POODLE vulnerability fix.</li> Fix a crash when loading flash plugins.</li> Fix build on GNU Hurd</li> Fix build on OS X.</li> Fix documentation of webkit_print_operation_get_page_setup().</li> Security fixes: CVE-2014-1344</a>, CVE-2014-1384</a>, CVE-2014-1385</a>, CVE-2014-1386</a>, CVE-2014-1387</a>, CVE-2014-1388</a>, CVE-2014-1389</a>, CVE-2014-1390</a>.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.7.3 released! 2014-12-16T00:00:00+00:00 This is a development release leading toward 2.8 series. What's new in the WebKitGTK+ 2.7.3 release?</h3> Add API to support HTML5 notifications.</li> Add UserMedia Permission Request API.</li> GObject DOM bindings API now correctly returns NULL intead of empty strings to be able to differentiate between not present and present but empty.</li> Add support for text-decoration-skip.</li> Improve the HTTP authentication dialog.</li> Expose the ID attribute of Meter and Option elements to accessibility.</li> Use latin1 instead of UTF-8 for HTTP header values.</li> Update NavigationItemProbes inspector icon.</li> Add video/mp2t as alternative mimetype for MPEG TS.</li> Add application/x-mpegurl and video/flv to the list of supported mimetypes.</li> Add SCHEDULING query support to HTTP media source element.</li> Fix deadlock when shutting down AudioDestination.</li> Translation updates: Kannada, Assamese</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.7.2 released! 2014-11-24T00:00:00+00:00 This is a development release leading toward 2.8 series. What's new in the WebKitGTK+ 2.7.2 release?</h3> Fix SSL connection issues with some websites after the POODLE vulnerability fix.</li> Add API to handle user script messages.</li> Add context menu API to Web Process Extensions.</li> Add API to create a WebKitWebContext.</li> Add API to override the default local storage directory.</li> Add WebKitWebResource::failed-with-tls-errors signal to notify about load failures due to TLS errors also in sub-resources.</li> Fix several crashes in accessibility implementation.</li> Fix XMLHttpRequest with a timeout when using the network process.</li> Fix XMLHttpRequest with cookies disabled when using the network process.</li> Fix a crash in the network process when a synchronous load redirects to a new url in a different security origin.</li> Fix a crash in TextureMapper when video resolution changes.</li> Correctly report the memory used by the media player to the garbage collector to make sure it’s freed when the video element is removed from the DOM.</li> Fix documentation of webkit_print_operation_get_page_setup().</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.6.4 released! 2014-11-21T00:00:00+00:00 This is a bug fix release in the stable 2.6 series. What's new in the WebKitGTK+ 2.6.4 release?</h3> Fix SSL connection issues with some websites after the POODLE vulnerability fix.</li> Fix several crashes in accessibility implementation.</li> Fix XMLHttpRequest with a timeout when using the network process.</li> Fix XMLHttpRequest with cookies disabled when using the network process.</li> Fix a crash in the network process when a synchronous load redirects to a new url in a different security origin.</li> Fix documentation of webkit_print_operation_get_page_setup().</li> Allow to build with GObject introspection disabled.</li> Fix the remote inspector when settings don't change after page initialization.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.6.3 released! 2014-11-12T00:00:00+00:00 This is a bug fix release in the stable 2.6 series. What's new in the WebKitGTK+ 2.6.3 release?</h3> Fix a crash when loading flash plugins.</li> Correctly report the memory used by the media player to the garbage collector to make sure it's freed when the video element is removed from the DOM.</li> Fix a crash in TextureMapper when video resolution changes.</li> Ensure that CSS-generated text content is exposed to assistive technologies.</li> Enable CSS_IMAGE_SET on production builds to fix some icons that are not rendered in the web inspector.</li> Fix the build on FreeBSD and GNU Hurd.</li> Fix the build with video disabled.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.7.1 released! 2014-10-28T00:00:00+00:00 This is the first development release leading toward 2.8 series. What's new in the WebKitGTK+ 2.7.1 release?</h3> Add initial gestures support. For now only drag, zoom and tap gestures are supported, but it's enough ot make WebKitGTK+ usable in touch screens. It requires GTK+ 3.14.</li> Add webkit_hit_test_result_context_is_selection().</li> The Web Inspector now uses a separate Web Process.</li> Add implementation of subtle crypto HMAC and digest algorithms.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.7 released! 2014-10-22T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.7 release?</h3> SSLv3 is now disabled in WebKit2 to protect us against POODLE vulnerability.</li> Fix the remote web inspector.</li> Fix rendering of buttons, selections and lists with recent GTK+ versions.</li> Fix the build with drag and drop support disabled.</li> Fix the build with video support disabled.</li> Fix a crash in the plugin process with some windowed flash plugins.</li> TLS errors now take precedence over the HTTP authentication dialog.</li> Do not shrink on-disk cache to its default size on startup.</li> Don't include full path names in WebKitEnumTypes.h to ensure the generated headers are always identical.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.6.2 released! 2014-10-22T00:00:00+00:00 This is a bug fix release in the stable 2.6 series. What's new in the WebKitGTK+ 2.6.2 release?</h3> SSLv3 is now disabled to protect us against POODLE vulnerability.</li> TLS errors are no longer ignored by default.</li> Fix the remote web inspector.</li> Fix rendering of buttons, selections and lists with recent GTK+ versions.</li> Improve performance of timers scheduled after a delay in microseconds.</li> Fix WebKitSettings:enable-smooth-scrolling to actually enable smooth scrolling.</li> Fix the build with drag and drop support disabled.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.6.1 released! 2014-10-13T00:00:00+00:00 This is the first bug fix release in the stable 2.6 series. What's new in the WebKitGTK+ 2.6.1 release?</h3> Ensure WebKitWebView:is-loading is TRUE right after a new load starts.</li> Fix a crash in the plugin process with some windowed flash plugins.</li> Allow to dock the inspector again once undocked when building with GTK+ >= 3.10.</li> TLS errors now take precedence over the HTTP authentication dialog.</li> Do not shrink on-disk cache to its default size on startup.</li> Improve the proportion and visibility of some web inspector icons.</li> Fix GTK+2 plugins not working after being updated.</li> Don't include full path names in WebKitEnumTypes.h to ensure the generated headers are always identical.</li> Translation updates: Telugu, Hindi.</li> </ul> Thanks to all the contributors who made possible this release. Non-free files in some versions of WebKitGTK+ 2014-10-01T00:00:00+00:00 We have noticed that some releases of WebKitGTK+ contain files that are covered by a license that does not allow redistribution. We have replaced those images with free equivalents, and have released WebKitGTK+ 2.2.8, 2.4.6, 2.5.90 and 2.6.0. These releases contain only free images. What files are affected?</h3> The Web Inspector images, located under Source/WebInspectorUI/UserInterface/Images/ What releases contain the non-free files?</h3> The 2.1.92 release</li> The 2.2.x series (excluding 2.2.8 and higher)</li> The 2.3.x series</li> The 2.4.x series (excluding 2.4.6 and higher)</li> The 2.5.x series (excluding 2.5.90 and higher)</li> </ul> What happens now with the affected releases?</h3> We have removed them from the archive, replacing them with new tarballs. The new tarballs have an 'a' appended to the version number ("2.1.92a", "2.4.3a", etc) and have the non-free images removed or replaced with the free ones where possible, but are else identical to the old ones. If you use any of the affected WebKitGTK+ releases, we urge you to upgrade to a version without the non-free images. WebKitGTK+ 2.2.8 released! 2014-10-01T00:00:00+00:00 This is a bug fix release in the stable 2.2 series. What's new in the WebKitGTK+ 2.2.8 release?</h3> Use free icons for the web inspector.</li> Fix selection rendering when unfocused with recent GTK+ versions.</li> Fix toggle buttons rendering with recent GTK+ versions.</li> Fix race condition when downloading a file due to the intermediate temporary file.</li> Do not freeze the UI process while scanning plugins if there's a GTK+ 3 plugin installed.</li> Make sure the plugins cache is always used even if the cache directory doesn't exist.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.6 released! 2014-09-29T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.6 release?</h3> Use free icons for the web inspector.</li> Make vimeo videos work again with the GStreamer media backend.</li> Fix selection rendering when unfocused with recent GTK+ versions.</li> Fix toggle buttons rendering with recent GTK+ versions.</li> Fix race condition when downloading a file due to the intermediate temporary file.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.6.0 released! 2014-09-24T00:00:00+00:00 This is the first stable release in the 2.6 series. Highlights of the WebKitGTK+ 2.6.0 release</h3> WebKit1 API has been removed.</li> Switch to CMake build system.</li> Binary version bump to make WebKit1 and WebKit2 parallel installable.</li> Several API changes.</li> The DOM bindings API has been split into stable and unstable parts.</li> Support for browser plugins using GTK+3, leaving the GTK+2 dependency optional for building a plugin process with support for GTK+2 plugins.</li> HighDPI support for non-accelerated compositing contents.</li> Dynamic user agent string depending on the site.</li> User scripts API.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.6 see the NEWS file that is included in the tarball. For more information about the API changes see: http://blogs.igalia.com/carlosgc/2014/08/01/webkitgtk-2-5-1-good-bye-webkit1/</a> For more information about the GTK+3 plugins see: http://blogs.igalia.com/carlosgc/2014/08/06/gtk-3-plugins-in-webkitgtk-and-evince-browser-plugin/</a> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.5.90 released! 2014-09-19T00:00:00+00:00 This is a development release leading toward 2.6 series. What's new in the WebKitGTK+ 2.5.90 release?</h3> Use free icons for the web inspector.</li> Change WebKitWebView::load-failed-with-tls-errors signal to pass the failing URI as signal argument instead of the host.</li> Add new API to allow overwrite existing files when downloading a file.</li> Add webkit_uri_response_get_http_headers() API.</li> Improve the UI of the HTTP authentication dialog.</li> Fix a crash when navigating away from a web page containing an ogg video.</li> Fix race condition when downloading a file due to the intermediate temporary file.</li> Fix toggle buttons rendering with recent GTK+ versions.</li> Fix selection rendering when unfocused with recent GTK+ versions.</li> Make the GStreamer media backend not send the transferMode HTTP header.</li> Translation updates: Assamese</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.5 released! 2014-08-26T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.5 release?</h3> Do not freeze the UI process while scanning plugins if there's a GTK+ 3 plugin installed.</li> Fix a crash when drag and drop to a WebKitWebView.</li> Fix a crash when navigating away from a web page containing an ogg video.</li> Fix slow motion rendering problem in GStreamer media backend due to integer rounding.</li> Make sure the plugins cache is always used even if the cache directory doesn’t exist.</li> Fix toggle buttons rendering with recent GTK+ versions.</li> Do not use GtkWindow:resize-grip-visible with recent GTK+ versions.</li> Add support for little-endian PowerPC64.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.5.3 released! 2014-08-15T00:00:00+00:00 This is a development release leading toward 2.6 series. What's new in the WebKitGTK+ 2.5.3 release?</h3> Fix a crash when drag and drop to a WebKitWebView.</li> Fix slow motion rendering problem in GStreamer media backend due to integer rounding.</li> Make sure the plugins cache is always used even if the cache directory doesn't exist.</li> Fix the build on FreeBSD.</li> Install the HTML API docs for WebKit2 and WebKitDOM in a versioned directory.</li> Intall the GObject instrospection files to the correct path.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.5.2 released! 2014-08-11T00:00:00+00:00 This is a development release leading toward 2.6 series. What's new in the WebKitGTK+ 2.5.2 release?</h3> Make GTK+2 dependency optional.</li> Use the ld version script for non developer builds.</li> Add webkit_navigation_policy_decision_get_navigation_action() API and deprecated the methods and properties in WebKitNavigationPolicyDecision that are now redundant.</li> Add support for user scripts to WebKitUserContentManager.</li> Do not use GtkWindow:resize-grip-visible with recent GTK+ versions.</li> Fix caps negotiation failure in playback pipeline in GSTreamer media backend.</li> Rename translation domain to WebKit2GTK-4.0.</li> Install the processes in a versioned directory.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.5.1 released! 2014-08-01T00:00:00+00:00 This is the first development release leading toward 2.6 series. What's new in the WebKitGTK+ 2.5.1 release?</h3> WebKit1 API has been removed.</li> Binary version bump to make WebKit1 and WebKit2 parallel installable.</li> Switch to CMake build system.</li> The WebKitWebView::create signal now receives a WebKitNavigationAction with information about the navigation action that triggered the signal.</li> WebKitWebViewGroup has been removed from the API and WebKitUserContentManager has been added to handle user stylesheets.</li> WebKitCertificateInfo has also been removed. WebKitWebView::load-failed-with-tls-errors signal now receives a GTlsCertificate and GTlsCertificateFlags, and webkit_web_context_allow_tls_certificate_for_host() receives a GTlsCertificate.</li> The view mode API (webkit_web_view_set_view_mode() and webkit_web_view_get_view_mode()) has been removed, since WebCore doesn't support view source mode anymore.</li> The DOM bindings API has been split into stable and unstable parts, and all deprecated methods have been removed. The stable part will keep API/ABI backwards compatibility, while the unstable part might change.</li> Add API to load arbitrary data optionally giving the encoding and MIME Type.</li> Add support for plugins using GTK+ 3.</li> Add HighDPI support for non-accelerated compositing contents.</li> Use a different user agent string depending on the site.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.4 released! 2014-07-08T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.4 release?</h3> Fix annoying popup shown when visiting 8tracks.com.</li> Expose links rendered as blocks to accessibility.</li> Make text inside "span" block in "a" block accessible.</li> Implement windowed plugins visibility.</li> Fix the GObject introspection annotations of webkit_web_resource_get_data_finish().</li> Fix a crash in TSymbolTableLevel::~TSymbolTableLevel when WebKit is built with GCC 4.9.</li> Fix a crash when playing a video in facebook.</li> Several user agent changes to fix Google Maps and a few other issues.</li> Allo to include WebKitVersion.h from web extensions API too.</li> Fix web process leak when closing pages with network process enabled.</li> Fix the build with --disable-webgl --disable-accelerated-compositing.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.3 released! 2014-05-26T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.3 release?</h3> Fix video playback rate used when resuming in GStreamer media backend.</li> Use GstMetaVideo as announced by WebKitVideoSink to fix some decoders and filters that rely on buffer's meta rather that in the caps structures.</li> Do not pass a valid pointer as redirected-response parameter to WebKitWebPage::send-request signal when not redirecting.</li> Add missing files to the build required for building in Windows.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.2 released! 2014-05-12T00:00:00+00:00 This is a bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.2 release?</h3> Correctly handle TLS errors in case of a server redirection.</li> Fix a crash when submitting a form.</li> Fix several JavaScriptCore crashes when browsing facebook.</li> Fix a crash when closing a page with windowed plugins.</li> Fix a crash after getting web view context property with g_object_get.</li> Fix a new[] delete[] mismatch in SocketStreamHandleSoup.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.2.7 released! 2014-04-30T00:00:00+00:00 This is a bug fix release in the stable 2.2 series. What's new in the WebKitGTK+ 2.2.7 release?</h3> Fix a crash when closing a page with windowed plugins.</li> Fix a crash after getting web view context property with g_object_get.</li> Fix wrong flags used in fcntl call that failed in FreeBSD.</li> Fix a crash in the plugin process with some plugins that redefine NPN functions.</li> Fix acceletared video when the video format has an alpha component.</li> Fix a crash in plugin process when loading GTK2 windowed plugins.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.1 released! 2014-04-14T00:00:00+00:00 This is the first bug fix release in the stable 2.4 series. What's new in the WebKitGTK+ 2.4.1 release?</h3> Add CORS support for media elements to GStreamer media backend.</li> Fix wrong flags used in fcntl call that failed in FreeBSD.</li> Correctly handle HTTP authentication for cross-origin requests.</li> Correctly handle cookies for cross-origin requests.</li> Fix a crash in the plugin process with some plugins that redefine NPN functions.</li> Fix acceletared video when the video format has an alpha component.</li> Fix sites using geolocation after reloading when using Geoclue2.</li> Append Safari version to UserAgent to fix redirections in www.globalforestwatch.org.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.4.0 released! 2014-03-24T00:00:00+00:00 This is the first stable release in the 2.4 series. Highlights of the WebKitGTK+ 2.4.0 release</h3> Support for multiple web processes</li> DOM touch events support</li> Plugins cache</li> Process model API</li> TLS errors API</li> Lots of bugs fixed</li> </ul> For more details about all the changes included in WebKitGTK+ 2.4 see the NEWS file that is included in the tarball, or see: http://blogs.igalia.com/carlosgc/2014/03/24/webkitgtk-2-4-0-the-multiprocess-made-easy/</a> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.2.6 released! 2014-03-19T00:00:00+00:00 This is a bug fix release in the stable 2.2 series. What's new in the WebKitGTK+ 2.2.6 release?</h3> Fix infinite loop in WebProcess due to a race condition that can happen when the socket event source is cancelled.</li> Use a persistent cache for plugins metadata to avoid blocking the UI while scanning plugins during page loads.</li> Make sure the web process doesn't finish if there's an ongoing print operation.</li> Fix web process leak when the WebView is leaked by the application.</li> Fix the generation of g_return macros for GObject DOM bindings in some cases where non pointer parameters were handled as pointers.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.3.92 released! 2014-03-17T00:00:00+00:00 This is a development release leading toward 2.4 series. What's new in the WebKitGTK+ 2.3.92 release?</h3> Add support for Geoclue2.</li> Always finalize the soup session object when the networking process finishes.</li> Make sure the web process doesn't finish if there's an ongoing print operation.</li> Fix runtime critical warnings about main loop sources not found when trying to remove them.</li> Fixed several crashes in JavaScriptCore when visiting facebook.</li> Improve CSS properties performance.</li> Fix web process leak when the WebView is leaked by the application.</li> Fix the build when using vala bindings due to UI and web process main headers included together.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.3.91 released! 2014-03-03T00:00:00+00:00 This is a development release leading toward 2.4 series. What's new in the WebKitGTK+ 2.3.91 release?</h3> Use a persistent cache for plugins metadata to avoid blocking the UI while scanning plugins during page loads.</li> Make the web inspector always load in multiprocess mode.</li> Add a pkg-config file for WebKit2 web process extensions API.</li> Fix the generation of g_return macros for GObject DOM bindings in some cases where non pointer parameters were handled as pointers.</li> Enable DFG_JIT on FreeBSD.</li> Use system default compiler instead of gcc when building DOM generated sources.</li> Several build fixes for FreeBSD.</li> Fix the build with wayland support enabled.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.2.5 released! 2014-02-19T00:00:00+00:00 This is a bug fix release in the stable 2.2 series. What's new in the WebKitGTK+ 2.2.5 release?</h3> Fix a crash in GStreamer media backend when playback rate is too high.</li> Fix wrong mix of fcntl commands and flags in WebKit2.</li> Fix a crash in facebook when hovering images.</li> Fix a crash when loading tbpl.mozilla.org.</li> Fix text encoding of pages loaded with webkit_web_view_load_html() in WebKit2.</li> Fix marshaller used in WebKitWebPage::document-loaded signal.</li> Fix a bug that prevented from entering fullscreen again in HTML5 videos after fullscreen was left with ESC.</li> Fix a web process crash when a download is cancelled.</li> Fix the build on FreeBSD.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.3.90 released! 2014-02-17T00:00:00+00:00 This is a development release leading toward 2.4 series. What's new in the WebKitGTK+ 2.3.90 release?</h3> Add initial touch support to WebKit2.</li> Add API to create a WebKitWebView related to another one to share the same Web Process.</li> Create the inspector view using the same web process as the inspected page.</li> Fix wrong mix of fcntl commands and flags in WebKit2.</li> Fix marshaller used in WebKitWebPage::document-loaded signal.</li> Fix a crash in GStreamer media backend when playback rate is too high.</li> Fix the build on FreeBSD.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.3.5 released! 2014-02-05T00:00:00+00:00 This is a development release leading toward 2.4 series. What's new in the WebKitGTK+ 2.3.5 release?</h3> Add API to allow setting a multiple web process model.</li> Add API to pass initialization user data from the UI process to the web extensions.</li> Implement languages support with network process.</li> Implement custom URI schemes with network process.</li> Disable MemoryCache when the DOCUMENT_VIEWER cache model is set.</li> Expose aria-describedby with ATK_RELATION_DESCRIBED_BY.</li> Fix a bug that prevented from entering fullscreen again in HTML5 videos after fullscreen was left with ESC.</li> Set playback rate when pipeline is not ready in GStreamer media backend.</li> Fix a lockup when playing Icecast radio in GStreamer media backend.</li> Fix a web process crash when a download is cancelled.</li> Fix several crashes when printing via JavaScript.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.2.4 released! 2014-01-21T00:00:00+00:00 This is a bug fix release in the stable 2.2 series. What's new in the WebKitGTK+ 2.2.4 release?</h3> Disable MemoryCache when the DOCUMENT_VIEWER cache model is set.</li> Remove the partial file downloaded when the download operation fails or is cancelled.</li> Enable Web Audio by default in configure.</li> Add missing mappings from ARIA roles to ATK roles.</li> Fix several crashes when printing via JavaScript.</li> Fix an X11 error when the backing store surface is destroyed.</li> Fix the user agent string to correctly pretend to be Mac OS X to fix several web sites that depen on the user agent like yahoo.</li> Fix the build with wayland support disabled.</li> Fix the build in FreeBSD.</li> Fix the build in Mac/Darwin.</li> Fix the build with GCC in i386.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.3.4 released! 2014-01-13T00:00:00+00:00 This is a development release leading toward 2.4 series. What's new in the WebKitGTK+ 2.3.4 release?</h3> Add API to WebKitResponsePolicyDecision to check if the MIME type can be shown.</li> Enable fullscreen API by default.</li> Fix handling of HTTP certificates with the network process enabled.</li> Fix downloads with the network process enabled.</li> Fix handling of cookies when network process is enabled.</li> Remove the partial file downloaded when the download operation fails or is cancelled.</li> Make WebKitWebPage::send-request signal work after a redirect.</li> Add xdg.origin.url extended attribute to downloads in WebKit2.</li> Fix WebGL with GLES.</li> Translation updates: Dutch, Brazilian Portuguese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.3.3 released! 2013-12-18T00:00:00+00:00 This is a development release leading toward 2.4 series. What's new in the WebKitGTK+ 2.3.3 release?</h3> Initial Network Process support disabled by default.</li> CSS regions are now enabled by default.</li> Support right-side attachment of the inspector in WebKit2.</li> Add spatial navigation setting to WebKit2 GTK+ API.</li> Add media source setting to both WebKit1 and WebKit2.</li> Support custom types for drag and drop data.</li> Avoid extra copy when drawing images in cairo backend.</li> Fix scrolling in combo boxes when the dropdown menu is larger than the screen.</li> Render AC layers also when using GTK+ 2 in WebKit1.</li> Fix return value of webkit_web_view_get_view_source_mode() in WebKit1.</li> Emit stream-start, caps and segment events in webkitwebaudiosrc element.</li> Fix seeking on media content provided by servers not supporting range requests.</li> Fix a crash when using media source in GStreamer media backend.</li> Fix an X11 error when the backing store surface is destroyed.</li> Expose splitter elements with ATK_ROLE_SEPARATOR to accessibility.</li> Expose accessibility objects WAI-ARIA landmark roles.</li> Expose accessibility objects with ATK_ROLE_ARTICLE.</li> Expose accessibility objects with ATK_ROLE_CHECK_MENU_ITEM.</li> Remove support for GStreamer 0.10.</li> Memory leak due to incorrect use of gst_tag_list_merge in TextCombinerGStreamer.</li> Translation updates: Brazilian Portuguese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.2.3 released! 2013-12-04T00:00:00+00:00 This is a bug fix release in the stable 2.2 series. What's new in the WebKitGTK+ 2.2.3 release?</h3> Render AC layers also when using GTK+ 2 in WebKit1.</li> Avoid extra copy when drawing images in cairo backend.</li> Fix return value of webkit_web_view_get_view_source_mode() in WebKit1.</li> Fix scrolling in combo boxes when the dropdown menu is larger than the screen.</li> Remove Chromium as user agent and claim to be Safari in OS X.</li> Fix a crash in the WebProcess when visiting www.pressure.co.uk.</li> Fix a crash JavaScriptcore with certain Google Drive documents.</li> Fix a crash in JavaScriptcore when running peacekeeper benchmark in 32 bit platforms.</li> Fix the build with freetype >= 2.5.1.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.3.2 released! 2013-11-18T00:00:00+00:00 This is a development release leading toward 2.4 series. What's new in the WebKitGTK+ 2.3.2 release?</h3> Add enable-media-stream setting to WebKit2 GTK+ API.</li> Fix a crash when load fails due to SSL errors in WebKit2.</li> Fix a crash when printing via JavaScript in WebKit2.</li> Add support audio and video tracks to GStreamer media backend.</li> Properly expose video and audio elements to accessibility.</li> Fix invalid cairo matrix when drawing too small surfaces.</li> Avoid extra copy when drawing images using cairo.</li> Do not omit playback rate when seeking in GStreamer media backend.</li> Several build fixes on non-linux platforms.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.2.2 released! 2013-11-11T00:00:00+00:00 This is a bug fix release in the stable 2.2 series. What's new in the WebKitGTK+ 2.2.2 release?</h3> Fix a crash when printing via JavaScript in WebKit2.</li> Enable text edition undo/redo operations support in WebKit2.</li> Fix the build on non-linux platforms.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.3.1 released! 2013-10-29T00:00:00+00:00 This is the first development release leading toward 2.4 series. What's new in the WebKitGTK+ 2.3.1 release?</h3> Add WebKit2 API for TLS errors.</li> Make EventTarget interface introspectable in GObject DOM bindings.</li> Expose WheelEvent in the GObject DOM bindings API.</li> Generate API documentation for GObject DOM bindings.</li> Respect image orientation by default.</li> Enable text edition undo/redo operations support in WebKit2.</li> Add suppport for blob URLs to GStreamer media backend.</li> Add support for subtitles.</li> Allow running the web process with an arbitrary prefix command in debug builds.</li> Expose image links properly to accessibility.</li> Expose title and alternative text for links in image maps to accessibility.</li> Cancel the current active WebKitAuthenticationRequest on load fail.</li> Fix several memory leaks.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.2.1 released! 2013-10-16T00:00:00+00:00 This is the first bug fix release in the stable 2.2 series. What's new in the WebKitGTK+ 2.2.1 release?</h3> Fix a crash in JavaScriptCore when visiting google groups.</li> Fix a crash in JavaScriptCore when trying to send a message via 'today's birthdays' dialogue box on Facebook.</li> Make sure the GtkWidget used for windowed plugins is destroyed when the plugin instance is destroyed.</li> Fix the build with drag and drop support disabled.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.2.0 released! 2013-09-27T00:00:00+00:00 This is the first stable release in the 2.2 series. Highlights of the WebKitGTK+ 2.2.0 release</h3> New Web Inspector</li> Initial Wayland support</li> Video accelerated compositing support</li> Custom JavaScript injection</li> Improved accessibility in WebKit2</li> HTTPS authentication API</li> Isolated worlds API</li> Lots of bugs fixed</li> </ul> For more details about all the changes included in WebKitGTK+ 2.2 see the NEWS file that is included in the tarball, or see: http://blogs.igalia.com/carlosgc/2013/09/27/webkitgtk-2-2-0-it-shines-and-doesnt-blink/</a> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.1.92 released! 2013-09-18T00:00:00+00:00 This is a development release leading toward 2.2 series. What's new in the WebKitGTK+ 2.1.92 release?</h3> Switch to the new Web Inspector.</li> Reimplement several accessibility methods to not require Gail and Pango.</li> Allow to run in a Wayland environment even when WebKitGTK+ has been built with accelerated compositing support enabled, falling back to software rendering in such case since accelerated compositing is not supported yet under Wayland.</li> Enable the Wayland target by default if the GTK+ Wayland dependency is available.</li> Fix web inspector rendering when docked in a page that uses accelerated compositing.</li> Do not try to parse incomplete HTTP requests in the web inspector.</li> Use WEBKIT_TYPE_DOWNLOAD instead of G_TYPE_OBJECT for the argument of the WebKitWebView::download-requested signal in WebKit1.</li> Add allow-none introspection annotation to parameters that can be NULL in GObject DOM bindings.</li> Honor the --disable-gtk-doc configure option.</li> Fix the build on directories containing spaces.</li> Allow to build when the build directory is in a different partition.</li> Translation updates: Polish, Brazilian Portuguese, Spanish, Galician</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.1.91 released! 2013-09-11T00:00:00+00:00 This is a development release leading toward 2.2 series. What's new in the WebKitGTK+ 2.1.91 release?</h3> Add a cancelled signal to WebKitAuthenticationRequest in WebKit2 GTK+ API.</li> Add support for building with Wayland as the target.</li> Fix issues with rtsp streams embedded on video tag not loading.</li> Fix the media player to not set the system volume to 100%.</li> Ensure volume slider value is 0 when audio is muted.</li> Make GStreamer source element thread-safe.</li> Adjust internal size on GStreamer source element when receiving data if necessary.</li> Disable accelerated compositing if the system doesn't support it.</li> Fix rendering of input buttons text with recent gnome-themes-standard.</li> Fix the cursor rendering when the mouse is over an image document with recent versions of GTK+.</li> Fix a crash in some cases when context menu is shown.</li> Fix the build on GNU/Hurd.</li> Translation updates: Brazilian Portuguese, Spanish.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.1.90.1 released! 2013-08-29T00:00:00+00:00 This is a development release leading toward 2.2 series. What's new in the WebKitGTK+ 2.1.90.1 release?</h3> Adds support for maintainer mode, so that the GNOME continuous integration will be able to forbid autotools regeneration</li> Added DOM bindings symbols that got removed from the IDL back for ABI compatibility</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.1.90 released! 2013-08-27T00:00:00+00:00 This is a development release leading toward 2.2 series. What's new in the WebKitGTK+ 2.1.90 release?</h3> Add API to inject custom JavaScript to WebKit2 Web Extensions API.</li> Add support for running JavaScript code in isolated worlds to WebKit2 Web Extensions API.</li> Expose WebKitFrame in WebKit2GTK+ Web Extensions API.</li> Fix the volume slider track shown when muted.</li> Cancel authentication dialog when the load fails.</li> Fix a crash in WebKit1 when inspector window is closed.</li> Translation updates: Brazilian Portuguese.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.1.4 released! 2013-08-12T00:00:00+00:00 This is a development release leading toward 2.2 series. What's new in the WebKitGTK+ 2.1.4 release?</h3> Add WebKitWebView::authenticate signal to WebKit2 GTK API.</li> Expose KeyboardEvent in GObject DOM bindings.</li> Implement attributesOfChildren() for AccessibilityUIElement.</li> Implement allAttributes() for AccessibilityUIElement.</li> Fix issues with edge cases when getting offsets for a text range in AtkText.</li> Remote inspector server now notifies about errors when loading resurces.</li> Disable HTTP request "Accept-Encoding:" header field on gstreamer source element to avoid receiving the wrong size when retrieving data.</li> Fix the final position when receiving several seek calls in a row, in GStreamer media backend.</li> When rendering accelerated video, upload onto the texture only the buffer to be painted.</li> Fix response property definition of WebKitResponsePolicyDecision.</li> Fix a crash in WebKit1 when the WebView is created and destroyed too fast.</li> Fix a crash in UI process when the web process crashes.</li> Fix a crash in WebKit2 when a context menu item is selected after the page has been closed.</li> Fix a crash when getting the editor command for a key event initiated by the web inspector.</li> Fix the build when building with GTK+ 2.</li> Fix several memory leaks.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.0.4 released! 2013-07-20T00:00:00+00:00 This is a bug fix release in the stable 2.0 series. What's new in the WebKitGTK+ 2.0.4 release?</h3> Fix a crash in GStreamer backend due to uninitialized log category.</li> Ensure that clicking on volume slider doesn't pause the media in GStreamer backend.</li> Fix a crash when getting the editor command for a key event initiated by the web inspector.</li> Actually disable the memory cache when DOCUMENT_VIEWER cache model is used in WebKit1.</li> Fix a crash in UI process when the web process crashes.</li> Fix a crash in WebKit2 when a context menu item is selected after the page has been closed.</li> Fix network errors when uploading a file containing special characters using input file element.</li> Fix debug build and some other build issues.</li> Fix several memory leaks.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.1.3 released! 2013-07-09T00:00:00+00:00 This is a development release leading toward 2.2 series. What's new in the WebKitGTK+ 2.1.3 release?</h3> Add support for preload="metadata" to GStreamer media backend.</li> Do not expose '\n' for wrapped lines with ATK_TEXT_BOUNDARY_CHAR.</li> Fix potential race condition in GStreamer media backend when getting the video sink caps.</li> Fix performance issues rendering a page with animations.</li> Several fixes and improvements in GStreamer video accelerated compositing support.</li> Adjust internal size on GStreamer HTTP source element when receiving data if necessary.</li> Actually disable the memory cache when DOCUMENT_VIEWER cache model is used in WebKit1.</li> Fix runtime critical warning in WebKit2 when unloading a module that failed to load.</li> Fix several memory leaks.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.1.2 released! 2013-06-18T00:00:00+00:00 This is a development release leading toward 2.2 series. What's new in the WebKitGTK+ 2.1.2 release?</h3> Set the subresources load priority using new libsoup API available in 2.43.</li> Do not use X11 WidgetBackingStore implementation in Wayland.</li> Support using GLContext from multiple threads.</li> Make sure gstreamer source element is thread-safe.</li> Prevent race condition when pad caps is set on gstreamer player.</li> Invalidate the ProcessLauncher when the process is terminated before it has finished launching</li> Use custom cairo code instead of Pango API for highlighting misspelled words.</li> Respect PKG_CONFIG env variable when generating gtk-doc.</li> Fix a crash due to an assert in gstreamer backend when seeking.</li> Fix memory leak when web process is terminated.</li> Translation updates: Telugu, Hindi, Kannada, Odia.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.0.3 released! 2013-06-11T00:00:00+00:00 This is a bug fix release in the stable 2.0 series. What's new in the WebKitGTK+ 2.0.3 release?</h3> Fix rendering of WebKitWebView child widgets with recent GTK+.</li> Use the inner node frame instead of the target frame to calculate the point of a hit test result in WebKit1.</li> Fix a crash when terminating a process that has not been fully launched.</li> Fix race conditions closing the socket descriptor when the web process crashes.</li> Fix a crash when a web page is closed.</li> Fix a crash when child iframe is removed during beforeload.</li> Fix parallel build when gtk-doc is enabled.</li> Fix build with MinGW compiler because of invalid cast.</li> Fix the build with WebAudio enabled.</li> Respect PKG_CONFIG env variable when generating gtk-doc.</li> Fix memory leak in WebKitBackForwardList.</li> Fix memory leak when web process is terminated.</li> Translation updates: Hindi, Telugu, Odia, Kannada, as-IN.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.1.1 released! 2013-05-29T00:00:00+00:00 This is the first development release leading toward 2.2 series. What's new in the WebKitGTK+ 2.1.1 release?</h3> Add webkit_uri_scheme_request_finish_error to WebKit2 GTK+ API.</li> Add a setting to control whether or not accelerated 2D canvas is enabled in WebKit2.</li> Add a setting to WebKit2 to allow sending console log messages to stdout.</li> Always use EGL to create the GL context when running on Wayland.</li> Fix rendering of WebKitWebView child widgets with recent GTK+.</li> Notify the web process in WebKitURISchemeRequest when we fail to read from the user InputStream.</li> Fixed race conditions closing the socket descriptor when the web process crashes.</li> Add video accelerated compositing support to the GStreamer backend.</li> Add support for audio/speex MIME type to the GStreamer backend.</li> Fix seek after video finished in GStreamer backend.</li> Initialize WebKitWebPlugin path to prevent double-free in WebKit1.</li> Fix several GObject instrospection warnings.</li> Fixed several memory leaks.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.0.2 released! 2013-05-13T00:00:00+00:00 This is a bug fix release in the stable 2.0 series. What's new in the WebKitGTK+ 2.0.2 release?</h3> Honor preload="none" attribute in GStreamer backend.</li> Make the GStreamer not to do memory buffering when preload set to none.</li> Fix loading of plugins when MIME Type is not provided but can guessed from the file extension.</li> Fix a crash with some locales due to some property names marked for translation by mistake.</li> Fix a double-free in WebKitWebPlugin.</li> Support C++11 static_assert.</li> Fix the build without GStreamer.</li> Fix the build with GCC 4.8 due to maybe-uninitialized errors.</li> Fix the build due to unresolved symbols in ProcessLauncherGtk.cpp.</li> Translation updates: Odia.</li> </ul> Thanks to all the contributors who made possible this release. WebKitGTK+ 2.0.1 released! 2013-04-16T00:00:00+00:00 This is the first bug fix release in the stable 2.0 series. What's new in the WebKitGTK+ 2.0.1 release?</h3> Fix a crash in Web Process when the UI process finishes too early.</li> Fix load notification of main resource when loaded from the memory cache.</li> Fix GObject DOM generation to make sure the right GType is used for every wrapped object.</li> Fix the build with non-bash shells.</li> Fix WebKit1 build in windows.</li> Several translation updates: Slovenian, Tamil, Hindi, gujarati, Malayalam.</li> </ul> Thanks to all the contributors who made possible this release, they are far too many to list! WebKitGTK+ 2.0.0 released! 2013-03-31T00:00:00+00:00 This is the first stable release in the 2.0 series. WebKitGTK+ 2.0.0 includes both the WebKit1 and WebKit2 APIs and are built by default. The WebKit2 API is now considered stable from the API/ABI backwards compatibility point of view. The WebKit1 API is in maintenance mode, we will continue fixing bugs but we don't plan to add new API. What's new in the WebKitGTK+ 2.0.0 release?</h3> Fix clip region of windowed plugins in WebKit2.</li> Fix compile warning in WebKit2 unit tests.</li> Fix the build with Python 3.</li> </ul> For more details about all the changes included in WebKitGTK+ 2.0 see the NEWS file that is included in the tarball, or see: http://blogs.igalia.com/carlosgc/2013/04/11/webkitgtk-2-0-0/</a> Thanks to all the contributors who made possible this release, they are far too many to list!

WebKitGTK

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0006

WebKitGTK 2.46.3 released!

What's new in the WebKitGTK 2.46.3 release?</h3> Flatten layers to a plane when preseve-3d style is set.</li> Fix DuckDuckGo links by adding a user agent quirk.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release.</p>

WebKitGTK 2.47.1 released!

WebKitGTK 2.46.2 released!

What's new in WebKitGTK 2.46?

WebKitGTK 2.46.1 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0005

WebKitGTK 2.46.0 released!

WebKitGTK 2.44.4 released

Checksums</h4> webkitgtk-2.44.4.tar.xz (34.2 MiB) md5sum: fd031b34f22c09f91e97cca3a7dbc426 sha1sum: 3699ff9c9b84e755a0736e72dfd6e5a13151f7d6 sha256sum: 2ce4ec1b78413035037aba8326b31ed72696626b7bea7bace5e46ac0d8cbe796 </pre>

WebKitGTK 2.45.92 released!

WebKitGTK 2.45.91 released!

WebKitGTK 2.45.90 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0004

WebKitGTK 2.44.3 released!

WebKitGTK 2.45.6 released!

WebKitGTK 2.45.5 released!

WebKitGTK 2.45.4 released!

WebKitGTK 2.45.3 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0003

WebKitGTK 2.44.2 released!

WebKitGTK 2.45.2 released!

WebKitGTK 2.45.1 released!

WebKitGTK 2.44.1 released!

What's new in WebKitGTK 2.44?

WebCodec API supported</h3> WebKitGTK now supports the WebCodecs API</a>, which allows web developers low-level access to video frames and audio chunks, a feature of importance for multimedia applications that need finer grain control over what gets played on the browser.</p>

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0002

WebKitGTK 2.44.0 released!

WebKitGTK 2.42.5 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001

WebKitGTK 2.43.4 released!

WebKitGTK 2.43.3 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0012

WebKitGTK 2.42.4 released!

WebKitGTK 2.42.3 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0011

WebKitGTK 2.43.2 released!

WebKitGTK 2.43.1 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0010

WebKitGTK 2.42.2 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0009

WebKitGTK 2.42.1 released!

What's new in the WebKitGTK 2.42.1 release?</h3> Fix enable-html5-database setting to properly enable/disable IndexedDB API.</li> Fix the build with GBM disabled.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release.</p>

WebKitGTK 2.42.0 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0008

WebKitGTK 2.41.92 released!

WebKitGTK 2.41.91 released!

WebKitGTK 2.41.90 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0007

WebKitGTK 2.40.5 released!

What's new in the WebKitGTK 2.40.5 release?</h3> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release.</p>

WebKitGTK 2.40.4 released!

What's new in the WebKitGTK 2.40.4 release?</h3> Fix a bug in JavaScript reading variable arguments in a call.</li> </ul> Thanks to all the contributors who made possible this release.</p>

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0006

WebKitGTK 2.41.6 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0005

WebKitGTK 2.40.3 released!

WebKitGTK 2.41.5 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0004

WebKitGTK 2.40.2 released!

WebKitGTK 2.41.4 released!

WebKitGTK 2.41.3 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003

WebKitGTK 2.38.6 released!

WebKitGTK 2.40.1 released!

WebKitGTK 2.41.2 released!

WebKitGTK 2.41.1 released!

WebKitGTK 2.40.0 released!

WebKitGTK 2.39.91 released!

WebKitGTK 2.39.90 released!

WebKitGTK 2.38.5 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0002

WebKitGTK 2.38.4 released!

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0001

WebKitGTK 2.39.7 released!

What's new in the WebKitGTK 2.39.7 release?</h3> Fix the webkit.h public header causing applications to fail to build.</li> Fix several crashes and rendering issues.</li> </ul> Thanks to all the contributors who made possible this release.</p>

WebKitGTK 2.39.6 released!

WebKitGTK 2.39.5 released!

What's new in the WebKitGTK 2.46.3 release?</h3>

Flatten layers to a plane when preseve-3d style is set.</li>
Fix DuckDuckGo links by adding a user agent quirk.</li>
Fix several crashes and rendering issues.</li> </ul>
Thanks to all the contributors who made possible this release.</p>

Checksums</h4>
webkitgtk-2.44.4.tar.xz (34.2 MiB) md5sum: fd031b34f22c09f91e97cca3a7dbc426 sha1sum: 3699ff9c9b84e755a0736e72dfd6e5a13151f7d6 sha256sum: 2ce4ec1b78413035037aba8326b31ed72696626b7bea7bace5e46ac0d8cbe796 </pre>

WebCodec API supported</h3>
WebKitGTK now supports the WebCodecs API</a>, which allows web developers low-level access to video frames and audio chunks, a feature of importance for multimedia applications that need finer grain control over what gets played on the browser.</p>

What's new in the WebKitGTK 2.42.1 release?</h3>

Fix enable-html5-database setting to properly enable/disable IndexedDB API.</li>
Fix the build with GBM disabled.</li>
Fix several crashes and rendering issues.</li> </ul>
Thanks to all the contributors who made possible this release.</p>

What's new in the WebKitGTK 2.40.5 release?</h3>

Fix several crashes and rendering issues.</li> </ul>
Thanks to all the contributors who made possible this release.</p>

What's new in the WebKitGTK 2.40.4 release?</h3>

Fix a bug in JavaScript reading variable arguments in a call.</li> </ul>
Thanks to all the contributors who made possible this release.</p>

What's new in the WebKitGTK 2.39.7 release?</h3>

Fix the webkit.h public header causing applications to fail to build.</li>
Fix several crashes and rendering issues.</li> </ul>
Thanks to all the contributors who made possible this release.</p>