Arch Linux Security Advisory ASA-202107-68
=========================================
Severity: High
Date    : 2021-07-27
CVE-ID  : CVE-2021-21775 CVE-2021-21779 CVE-2021-30663 CVE-2021-30665
          CVE-2021-30689 CVE-2021-30720 CVE-2021-30734 CVE-2021-30744
          CVE-2021-30749 CVE-2021-30795 CVE-2021-30797 CVE-2021-30799
Package : wpewebkit
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2221

Summary
======
The package wpewebkit before version 2.32.3-1 is vulnerable to multiple
issues including arbitrary code execution, access restriction bypass,
cross-site scripting and information disclosure.

Resolution
=========
Upgrade to 2.32.3-1.

# pacman -Syu "wpewebkit>=2.32.3-1"

The problems have been fixed upstream in version 2.32.3.

Workaround
=========
None.

Description
==========
- CVE-2021-21775 (information disclosure)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. A use-after-free vulnerability exists in the way certain events
are processed for ImageLoader objects of WebKit. A specially crafted
web page can lead to a potential information leak and further memory
corruption. In order to trigger the vulnerability, a victim must be
tricked into visiting a malicious webpage.

- CVE-2021-21779 (information disclosure)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. A use-after-free vulnerability exists in the way that WebKit
GraphicsContext handles certain events. A specially crafted web page
can lead to a potential information leak and further memory corruption.
A victim must be tricked into visiting a malicious web page to trigger
this vulnerability.

- CVE-2021-30663 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to
arbitrary code execution.

- CVE-2021-30665 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue
may have been actively exploited.

- CVE-2021-30689 (cross-site scripting)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to
universal cross site scripting.

- CVE-2021-30720 (access restriction bypass)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. A malicious website may be able to access restricted ports on
arbitrary servers.

- CVE-2021-30734 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to
arbitrary code execution.

- CVE-2021-30744 (cross-site scripting)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to
universal cross site scripting.

- CVE-2021-30749 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to
arbitrary code execution.

- CVE-2021-30795 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to
arbitrary code execution.

- CVE-2021-30797 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to code
execution.

- CVE-2021-30799 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.32.3. Processing maliciously crafted web content may lead to
arbitrary code execution.

Impact
=====
A remote attacker could execute arbitrary code or disclose sensitive
information through crafted web content. Apple is aware of a report
that one of the arbitrary code execution issues may have been actively
exploited.

References
=========
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-21775
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1229
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-21779
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1238
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30663
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30665
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30689
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30720
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30734
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30744
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30749
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30795
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30797
https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30799
https://security.archlinux.org/CVE-2021-21775
https://security.archlinux.org/CVE-2021-21779
https://security.archlinux.org/CVE-2021-30663
https://security.archlinux.org/CVE-2021-30665
https://security.archlinux.org/CVE-2021-30689
https://security.archlinux.org/CVE-2021-30720
https://security.archlinux.org/CVE-2021-30734
https://security.archlinux.org/CVE-2021-30744
https://security.archlinux.org/CVE-2021-30749
https://security.archlinux.org/CVE-2021-30795
https://security.archlinux.org/CVE-2021-30797
https://security.archlinux.org/CVE-2021-30799

ArchLinux: 202107-68: wpewebkit: multiple issues

July 30, 2021

Summary

- CVE-2021-21775 (information disclosure) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of WebKit. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage.
- CVE-2021-21779 (information disclosure)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A use-after-free vulnerability exists in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability.
- CVE-2021-30663 (arbitrary code execution)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2021-30665 (arbitrary code execution)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2021-30689 (cross-site scripting)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to universal cross site scripting.
- CVE-2021-30720 (access restriction bypass)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A malicious website may be able to access restricted ports on arbitrary servers.
- CVE-2021-30734 (arbitrary code execution)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2021-30744 (cross-site scripting)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to universal cross site scripting.
- CVE-2021-30749 (arbitrary code execution)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2021-30795 (arbitrary code execution)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2021-30797 (arbitrary code execution)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to code execution.
- CVE-2021-30799 (arbitrary code execution)
A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution.

Resolution

Upgrade to 2.32.3-1. # pacman -Syu "wpewebkit>=2.32.3-1"
The problems have been fixed upstream in version 2.32.3.

References

https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-21775 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1229 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-21779 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1238 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30663 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30665 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30689 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30720 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30734 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30744 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30749 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30795 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30797 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30799 https://security.archlinux.org/CVE-2021-21775 https://security.archlinux.org/CVE-2021-21779 https://security.archlinux.org/CVE-2021-30663 https://security.archlinux.org/CVE-2021-30665 https://security.archlinux.org/CVE-2021-30689 https://security.archlinux.org/CVE-2021-30720 https://security.archlinux.org/CVE-2021-30734 https://security.archlinux.org/CVE-2021-30744 https://security.archlinux.org/CVE-2021-30749 https://security.archlinux.org/CVE-2021-30795 https://security.archlinux.org/CVE-2021-30797 https://security.archlinux.org/CVE-2021-30799

Severity
CVE-2021-30689 CVE-2021-30720 CVE-2021-30734 CVE-2021-30744
CVE-2021-30749 CVE-2021-30795 CVE-2021-30797 CVE-2021-30799
Package : wpewebkit
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2221

Workaround

None.

Related News

Parrot OS 6.3: Elevating Security with Enhanced Features & Tools
3 - 5 min read
Parrot OS 6.3 has just arrived , bringing crucial updates that security admins should note. This latest version of the popular secure Linux
Linux Kernel 6.14 Released: Top Security Features You Need to Know
3 - 6 min read
With the release of Linux kernel 6.14 , admins and Linux users have many new features and enhancements to look forward to - especially in the realm
Don
2 - 4 min read
Google recently issued a crucial Chrome update that those using a version of the browser prior to version 132.0.6834.110 should implement
Intel Brings Next-Level Security to Linux with Partner Security Engine
3 - 6 min read
Intel recently introduced a game-changer in hardware security with its new Partner Security Engine integrated into the Core Ultra Series 2. This
A Tiny Linux Kernel Tweak with Massive Implications for Datacenter Efficiency
3 - 6 min read
In a groundbreaking development, security researchers have introduced a small but mighty tweak to the Linux kernel that promises to cut data center
Best Practices for Securing Linux Systems Against Malicious Bots
3 - 6 min read
Linux systems have long been an indispensable asset to businesses and individuals alike. From running servers and cloud infrastructure to powering
Securing Open-Source Projects with Automated Testing on Linux
4 - 7 min read
Open-source project security testing focuses on many components, ensuring there are no safety vulnerabilities. These components include physical
KaOS Linux 2025.01: Merging Security with Practicality
3 - 6 min read
As the realm of Linux distribution expands, security admins find themselves faced with choosing a system that fits operational needs and upholds

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved