what you don't know can hurt you

WebKitGTK+ / WPE WebKit Code Execution / Cross Site Scripting

WebKitGTK+ / WPE WebKit Code Execution / Cross Site Scripting
Posted Nov 22, 2018
Authored by WebKitGTK+ Team

WebKitGTK+ and WPE WebKit suffer from code execution, cross site scripting, and various other vulnerabilities.

tags | advisory, vulnerability, code execution, xss
advisories | CVE-2018-4345, CVE-2018-4372, CVE-2018-4373, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4386, CVE-2018-4392, CVE-2018-4416
MD5 | 4c0dbc848117ab6a612ba029815f2d9f

WebKitGTK+ / WPE WebKit Code Execution / Cross Site Scripting

Change Mirror Download
------------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0008
------------------------------------------------------------------------

Date reported : November 21, 2018
Advisory ID : WSA-2018-0008
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0008.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0008.html
CVE identifiers : CVE-2018-4345, CVE-2018-4372, CVE-2018-4373,
CVE-2018-4375, CVE-2018-4376, CVE-2018-4378,
CVE-2018-4382, CVE-2018-4386, CVE-2018-4392,
CVE-2018-4416.

Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.

CVE-2018-4345
Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before
2.22.1.
Credit to an anonymous researcher.
A cross-site scripting issue existed in WebKit. This issue was
addressed with improved URL validation.

CVE-2018-4372
Versions affected: WebKitGTK+ before 2.22.4 and WPE WebKit before
2.22.2.
Credit to HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST
Softsec Lab, Korea.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.

CVE-2018-4373
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to ngg, alippai, DirtYiCE, KT of Tresorit working with Trend
Microys Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.

CVE-2018-4375
Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before
2.22.0.
Credit to Yu Haiwan and Wu Hongjun From Nanyang Technological
University working with Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.

CVE-2018-4376
Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before
2.22.0.
Credit to 010 working with Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.

CVE-2018-4378
Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before
2.22.0.
Credit to an anonymous researcher, zhunki of 360 ESG Codesafe Team.
Processing maliciously crafted web content may lead to code
execution. A memory corruption issue was addressed with improved
validation.

CVE-2018-4382
Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before
2.22.0.
Credit to lokihardt of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.

CVE-2018-4386
Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before
2.22.1.
Credit to lokihardt of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.

CVE-2018-4392
Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before
2.22.0.
Credit to zhunki of 360 ESG Codesafe Team.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.

CVE-2018-4416
Versions affected: WebKitGTK+ before 2.22.1 and WPE WebKit before
2.22.0.
Credit to lokihardt of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.


We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.

Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.

The WebKitGTK+ and WPE WebKit team,
November 21, 2018

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

January 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    15 Files
  • 2
    Jan 2nd
    15 Files
  • 3
    Jan 3rd
    11 Files
  • 4
    Jan 4th
    1 Files
  • 5
    Jan 5th
    2 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    24 Files
  • 8
    Jan 8th
    15 Files
  • 9
    Jan 9th
    16 Files
  • 10
    Jan 10th
    23 Files
  • 11
    Jan 11th
    17 Files
  • 12
    Jan 12th
    3 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    18 Files
  • 15
    Jan 15th
    33 Files
  • 16
    Jan 16th
    23 Files
  • 17
    Jan 17th
    29 Files
  • 18
    Jan 18th
    15 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close