WebKitGTK

WebKitGTK+ Security Advisory WSA-2017-0004

• Date Reported: May 25, 2017

• Advisory ID: WSA-2017-0004

• CVE identifiers: CVE-2017-2496, CVE-2017-2504, CVE-2017-2505, CVE-2017-2506, CVE-2017-2508, CVE-2017-2510, CVE-2017-2514, CVE-2017-2515, CVE-2017-2521, CVE-2017-2525, CVE-2017-2526, CVE-2017-2528, CVE-2017-2530, CVE-2017-2531, CVE-2017-2536, CVE-2017-2539, CVE-2017-2544, CVE-2017-2547, CVE-2017-2549, CVE-2017-6980, CVE-2017-6984.

Several vulnerabilities were discovered in WebKitGTK+.

• CVE-2017-2496

  • Versions affected: WebKitGTK+ before 2.16.3.
  • Credit to Apple.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2504

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in the handling of WebKit Editor commands. This issue was addressed with improved state management.

• CVE-2017-2505

  • Versions affected: WebKitGTK+ before 2.16.0.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2506

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to Zheng Huang of the Baidu Security Lab working with Trend Micro’s Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2508

  • Versions affected: WebKitGTK+ before 2.16.0.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in the handling of WebKit container nodes. This issue was addressed with improved state management.

• CVE-2017-2510

  • Versions affected: WebKitGTK+ before 2.16.3.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in the handling of pageshow events. This issue was addressed with improved state management.

• CVE-2017-2514

  • Versions affected: WebKitGTK+ before 2.16.0.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2515

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2521

  • Versions affected: WebKitGTK+ before 2.16.0.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2525

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2526

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2528

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in the handling of WebKit cached frames. This issue was addressed with improved state management.

• CVE-2017-2530

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to Wei Yuan of Baidu Security Lab.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2531

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2536

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to Samuel Groß and Niklas Baumstark working with Trend Micro's Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2539

  • Versions affected: WebKitGTK+ before 2.16.3.
  • Credit to Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2544

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to 360 Security (@mj0011sec) working with Trend Micro's Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2547

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to lokihardt of Google Project Zero, Team Sniper (Keen Lab and PC Mgr) working with Trend Micro's Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-2549

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to universal cross site scripting (UXSS). Description: A logic issue existed in frame loading. This issue was addressed with improved state management.

• CVE-2017-6980

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

• CVE-2017-6984

  • Versions affected: WebKitGTK+ before 2.16.1.
  • Credit to lokihardt of Google Project Zero.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or cause a denial of service (memory corruption and application crash). Description: Multiple memory corruption issues were addressed with improved memory handling.

We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases.

Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html

Go Back