WebKitGTK and WPE WebKit Security Advisory WSA-2020-0005

--x8RKF1fwUHmVPfFDuQ0vuI2QFOTE1n5yE
Content-Type: multipart/mixed; boundary="3QzPkyyqhEaSlZKCLOVLdM5YeQ39e6SSr";
 protected-headers="v1"
From: Carlos Alberto Lopez Perez <[email protected]>
To: [email protected], [email protected]
Cc: [email protected], [email protected],
 [email protected], bugtraq-o7tR/nIX9Vi1EmJ4MpGYnQC/[email protected]
Message-ID: <4c8e7b25-c496-fa56-3a73-4424ad0d4e0f-wEGTBA9jqPzQT0dZR+AlfA@public.gmane.org>
Subject: WebKitGTK and WPE WebKit Security Advisory WSA-2020-0005

--3QzPkyyqhEaSlZKCLOVLdM5YeQ39e6SSr
Content-Type: text/plain; charset=utf-8
Content-Language: en-GB
Content-Transfer-Encoding: quoted-printable

------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory                 WSA-2020-0005
------------------------------------------------------------------------

Date reported           : April 27, 2020
Advisory ID             : WSA-2020-0005
WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2020-0005.ht=
ml
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2020-0005.ht=
ml
CVE identifiers         : CVE-2020-3885, CVE-2020-3894, CVE-2020-3895,
                          CVE-2020-3897, CVE-2020-3899, CVE-2020-3900,
                          CVE-2020-3901, CVE-2020-3902.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2020-3885
    Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before
    2.28.0.
    Credit to Ryan Pickren (ryanpickren.com).
    Impact: A file URL may be incorrectly processed. Description: A
    logic issue was addressed with improved restrictions.

CVE-2020-3894
    Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before
    2.28.0.
    Credit to Sergei Glazunov of Google Project Zero.
    Impact: An application may be able to read restricted memory.
    Description: A race condition was addressed with additional
    validation.

CVE-2020-3895
    Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before
    2.28.0.
    Credit to grigoritchy.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: A memory corruption issue was
    addressed with improved memory handling.

CVE-2020-3897
    Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before
    2.28.0.
    Credit to Brendan Draper (@6r3nd4n) working with Trend Micro=E2=80=99=
s Zero
    Day Initiative.
    Impact: A remote attacker may be able to cause arbitrary code
    execution. Description: A type confusion issue was addressed with
    improved memory handling.

CVE-2020-3899
    Versions affected: WebKitGTK before 2.28.2 and WPE WebKit before
    2.28.2.
    Credit to OSS-Fuzz.
    Impact: A remote attacker may be able to cause arbitrary code
    execution. Description: A memory consumption issue was addressed
    with improved memory handling.

CVE-2020-3900
    Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before
    2.28.0.
    Credit to Dongzhuo Zhao working with ADLab of Venustech.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: A memory corruption issue was
    addressed with improved memory handling.

CVE-2020-3901
    Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before
    2.28.0.
    Credit to Benjamin Randazzo (@____benjamin).
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: A type confusion issue was
    addressed with improved memory handling.

CVE-2020-3902
    Versions affected: WebKitGTK before 2.28.0 and WPE WebKit before
    2.28.0.
    Credit to Yi=C4=9Fit Can YILMAZ (@yilmazcanyigit).
    Impact: Processing maliciously crafted web content may lead to a
    cross site scripting attack. Description: An input validation issue
    was addressed with improved input validation.


We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.

The WebKitGTK and WPE WebKit team,
April 27, 2020


--3QzPkyyqhEaSlZKCLOVLdM5YeQ39e6SSr--

--x8RKF1fwUHmVPfFDuQ0vuI2QFOTE1n5yE
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: You can fetch my GnuPG key from http://key.neutrino.es

iQIzBAEBCgAdFiEEtdK1C8SOx/HukNmrllCJzmuV+IIFAl6nEngACgkQllCJzmuV
+ILkAA//dKQAHN6A4FvmX28aVgwmUpkr4gAhNMDxJZqWRQk9rBMyJFEIW3m1EIvX
jd8zUwaAecmoytSnif1rlUeQEZm934ae/4sIKGp+r+9RbnX35u3sDPaNCBbGbUmI
Wf1SsXZ98I96PGhN4+wgqs2PHtemwC6jgKtAih4JYk+jifNBER6GRz9Ulgs6Jf2O
8yrkVDKFk2TsSDVc3PzPnPPP0AxZxdpZETP5RpBQOJQ7l5DBX67PmT/utgmyVfba
lkiGFrp9mbI1liZy0VPvdnvP7o4rwK/+suskUpYN/1dLuYkfU0HlJLgAojk+lfbZ
l9PsC7TzNsiXyJxjhUNeETGdZegO0P5DHIGuPqEmLbxbDMRQYNSROHeix7vc+BZn
YYuOQXp69etnOt6WxpjvkHOEzZwPjgutTmCatjdygioP/YK/H/fa7owD1otehT8b
jhMVJHWh34BPJciqciuuxUtAXrIiqIuQnVPrxR/dsvEiF+Ofu91Mr8QAmhWB7Ld6
y2bB0PDUeIfBScMVcGOnPPIni6w8+fyga4rzdvyIiWv6pf1YgLSp5Z516UgpwWeV
yadH5wXfJ+Mf6pZnsLMVP/LbBz+xJFYp9R7oBCW92+EEMsVuR2IevqrXzFXtFD5a
U9Utmm04nwCOEhV4DotZldE8rYrJG/K1KNpa/zgtXUpZwoNdsrk=
=ADoR
-----END PGP SIGNATURE-----

--x8RKF1fwUHmVPfFDuQ0vuI2QFOTE1n5yE--