Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.0555
webkit2gtk security update
19 February 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: webkit2gtk
Publisher: Debian
Operating System: Debian GNU/Linux 10
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2020-3868 CVE-2020-3867 CVE-2020-3865
CVE-2020-3864 CVE-2020-3862
Reference: ESB-2020.0538
ESB-2020.0355
ESB-2020.0346
Original Bulletin:
http://www.debian.org/security/2020/dsa-4627
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4627-1 security@debian.org
https://www.debian.org/security/ Alberto Garcia
February 17, 2020 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : webkit2gtk
CVE ID : CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867
CVE-2020-3868
The following vulnerabilities have been discovered in the webkit2gtk
web engine:
CVE-2020-3862
Srikanth Gatta discovered that a malicious website may be able to
cause a denial of service.
CVE-2020-3864
Ryan Pickren discovered that a DOM object context may not have had
a unique security origin.
CVE-2020-3865
Ryan Pickren discovered that a top-level DOM object context may
have incorrectly been considered secure.
CVE-2020-3867
An anonymous researcher discovered that processing maliciously
crafted web content may lead to universal cross site scripting.
CVE-2020-3868
Marcin Towalski discovered that processing maliciously crafted web
content may lead to arbitrary code execution.
For the stable distribution (buster), these problems have been fixed in
version 2.26.4-1~deb10u1.
We recommend that you upgrade your webkit2gtk packages.
For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl5K+WoACgkQEMKTtsN8
TjbGnQ/7BirfUXyMQ9++MbcuusVvlTEl4ka9pCSb9/+H5YYrNM73gBMdATwVR0ka
jSOi2DQZwalJPSEBEy4tg8EmLHVY2qWbJ9gqYjaj6xmz3o2ZPTHlTiEMHdLf2SMp
6EbTo3E8NVHJhSSk+/wthB0ajV2/1it6yUFzPZo50PmbJb4Eh7q9iurO2Hdkd+L9
UXDOFsbYBbaCg7F+08ax1tE73Xa0B61YzJISqWFdLsn3R1a1OoasV1zeK9Gj4AYw
sfl8Le5un8zYCKx0sjR6DhZPh998rebOi9RHPiwHQnvRob2gPMFBRGiKiBROGIz3
RAeZ1dMg1vKKV87TpPWpsXHRkXo9wfD+gGULHbriqwdW8YFHGGqB6uZL90IxMDIl
EjB9vpVRbDyofkSLg4KOnifYTVntq7nlu62c5s5AooH44TxmLSppcty/fNsKd9Dn
r1r8x72OFWRNQT/2dAbcMOYUXXvldNxOriuj4EthPHkL0UDnYbnu2P5rdPMFi4W7
mYIS7qOLPgc6DJ6hfBFIFV84x/jVVorPUdHDH+1yIhHbpGPPGXJlHtkh8eCSOmue
zZDmNTRLNwroAkPiGJvPWyfR8VbeX0ok5hWVrjV1zyeIgrFyS6+gGdQt370hbK6g
dV+ADko8mhB8cekjVmAW9FT2BZH4Lu/gyoB72LvKGPqC9O93R8k=
=nQjm
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXky0e2aOgq3Tt24GAQgGNRAAmTfZhAtc6Ig2QrTvpfCY/oWx243HSFpY
bXgD0iZTw68JlIBQIKwdXpD/Lhjpjl21hx8yVw9qctZnXYu5j2h10W9WZNafhQsM
2H7k4cqs3u1xugkXChuaHzlVdJ+ntMdy8QVxhwQNdRD3efF1Eeg6f+pLAwd2JSVI
/RZf8VwvmFt90uIYQOesiQB5g6o8Us4X0vUpAQXXVFkViWwA78kcKyx4X+r60/lt
41ne9uMaDV5Set/TwpghQ16T2REvu37dSvssVQaPzmzSeRqxnvYzwocVw5dj2r8X
VRTe4FSH8ztab/0tppMorB5RDzsymghJGmnd5xMj/YilH3LudYWV0rSMF8Gjk5XF
pcbbXTA+pefXA0MGtgLvQsaCA+7T8DpjGZ501a1CN1tg/cxnYTURp8jFayJ9+9gR
nyEdZzZScK8uaOW3lTyq3wd7Te+r04gstluboZEbEgDsp2Ox3sEEifvx3xFc9JXT
fd7n7vCklx/SUlcAHH2eV0uLYv98BVIa8coIfaEfeJS30PbU30j62EF6WATfqax6
tZkLp42stI4QZ+GHphtW0/5x8I/AXHasx0F3QpCRQPAGjQNAcM0fvtgskSWmmTeA
Iw1wjaZlcKBwboEgTM5hee0yLlo4lQmsbZaIrxAJHmJqjADcP9qwlMn6Bj9EiGsU
tAx9Jdj+j8g=
=DIgI
-----END PGP SIGNATURE-----