Bug 1201221

Summary:	VUL-0: webkit2gtk3: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0006
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Carlos López <carlos.lopez>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	mgorse
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-22662:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) CVSSv3.1:SUSE:CVE-2022-22677:4.3:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) CVSSv3.1:SUSE:CVE-2022-26710:8.8:(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Carlos López 2022-07-05 12:16:22 UTC

------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory                 WSA-2022-0006
------------------------------------------------------------------------

Date reported           : July 05, 2022
Advisory ID             : WSA-2022-0006
WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2022-0006.html
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2022-0006.html
CVE identifiers         : CVE-2022-22662, CVE-2022-22677, CVE-2022-26710.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2022-22662
    Versions affected: WebKitGTK and WPE WebKit before 2.36.0.
    Credit to Prakash (@1lastBr3ath) of Threat Nix.
    Impact: Processing maliciously crafted web content may disclose
    sensitive user information. Description: A cookie management issue
    was addressed with improved state management.

CVE-2022-22677
    Versions affected: WebKitGTK and WPE WebKit before 2.36.4.
    Credit to an anonymous researcher.
    Impact: The video in a webRTC call may be interrupted if the audio
    capture gets interrupted. Description: A logic issue in the handling
    of concurrent media was addressed with improved state handling.

CVE-2022-26710
    Versions affected: WebKitGTK and WPE WebKit before 2.36.4.
    Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: A use after free issue was
    addressed with improved memory management.


We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.

The WebKitGTK and WPE WebKit team,

July 05, 2022

Comment 3 Swamp Workflow Management 2022-07-22 11:39:40 UTC

SUSE-SU-2022:2525-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1201221
CVE References: CVE-2022-22662,CVE-2022-22677,CVE-2022-26710
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    webkit2gtk3-2.36.4-150200.38.2
openSUSE Leap 15.3 (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Manager Server 4.1 (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Manager Retail Branch Server 4.1 (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Manager Proxy 4.1 (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Linux Enterprise Server 15-SP2-BCL (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    webkit2gtk3-2.36.4-150200.38.2
SUSE Enterprise Storage 7 (src):    webkit2gtk3-2.36.4-150200.38.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 4 Swamp Workflow Management 2022-07-22 11:40:27 UTC

SUSE-SU-2022:2522-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1201221
CVE References: CVE-2022-22662,CVE-2022-22677,CVE-2022-26710
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    webkit2gtk3-2.36.4-2.102.1
SUSE OpenStack Cloud 9 (src):    webkit2gtk3-2.36.4-2.102.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    webkit2gtk3-2.36.4-2.102.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    webkit2gtk3-2.36.4-2.102.1
SUSE Linux Enterprise Server 12-SP5 (src):    webkit2gtk3-2.36.4-2.102.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    webkit2gtk3-2.36.4-2.102.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    webkit2gtk3-2.36.4-2.102.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    webkit2gtk3-2.36.4-2.102.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 5 Swamp Workflow Management 2022-07-22 11:41:16 UTC

SUSE-SU-2022:2523-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1201221
CVE References: CVE-2022-22662,CVE-2022-22677,CVE-2022-26710
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    webkit2gtk3-2.36.4-150400.4.6.2, webkit2gtk3-soup2-2.36.4-150400.4.6.2, webkit2gtk4-2.36.4-150400.4.6.2
SUSE Linux Enterprise Module for Development Tools 15-SP4 (src):    webkit2gtk4-2.36.4-150400.4.6.2
SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (src):    webkit2gtk3-2.36.4-150400.4.6.2
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    webkit2gtk3-soup2-2.36.4-150400.4.6.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 6 Swamp Workflow Management 2022-07-22 11:42:06 UTC

SUSE-SU-2022:2524-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1201221
CVE References: CVE-2022-22662,CVE-2022-22677,CVE-2022-26710
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Linux Enterprise Server for SAP 15 (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Linux Enterprise Server 15-LTSS (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE Enterprise Storage 6 (src):    webkit2gtk3-2.36.4-150000.3.106.1
SUSE CaaS Platform 4.0 (src):    webkit2gtk3-2.36.4-150000.3.106.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.