First Last Prev Next    This bug is not in your last search results.
Bug 1174662 - (CVE-2020-9862) VUL-0: CVE-2020-9862,CVE-2020-9893,CVE-2020-9894,CVE-2020-9895,CVE-2020-9915,CVE-2020-9925: webkit2gtk3: WebKitGTK and WPE WebKit Security Advisory WSA-2020-0007
(CVE-2020-9862)
VUL-0: CVE-2020-9862,CVE-2020-9893,CVE-2020-9894,CVE-2020-9895,CVE-2020-9915,...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/264460/
CVSSv3.1:SUSE:CVE-2020-9862:4.5:(AV:L...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2020-07-29 11:37 UTC by Alexandros Toptsoglou
Modified: 2020-08-27 22:14 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2020-07-29 11:37:17 UTC 
------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory                 WSA-2020-0007
------------------------------------------------------------------------

Date reported           : July 29, 2020
Advisory ID             : WSA-2020-0007
WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2020-0007.html
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2020-0007.html
CVE identifiers         : CVE-2020-9862, CVE-2020-9893, CVE-2020-9894,
                          CVE-2020-9895, CVE-2020-9915, CVE-2020-9925.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2020-9862
    Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4
    Credit to Ophir Lojkine (@lovasoa).
    Impact: Copying a URL from Web Inspector may lead to command
    injection. Description: A command injection issue existed in Web
    Inspector. This issue was addressed with improved escaping.

CVE-2020-9893
    Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4
    Credit to 0011 working with Trend Micro Zero Day Initiative.
    Impact: A remote attacker may be able to cause unexpected
    application termination or arbitrary code execution. Description: An
    use-after-free issue was addressed with improved memory management.

CVE-2020-9894
    Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4
    Credit to 0011 working with Trend Micro Zero Day Initiative.
    Impact: A remote attacker may be able to cause unexpected
    application termination or arbitrary code execution. Description: An
    out-of-bounds read was addressed with improved input validation.

CVE-2020-9895
    Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4
    Credit to Wen Xu of SSLab, Georgia Tech.
    Impact: A remote attacker may be able to cause unexpected
    application termination or arbitrary code execution. Description: An
    use-after-free issue was addressed with improved memory management.

CVE-2020-9915
    Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4
    Credit to Ayoub AIT ELMOKHTAR of Noon.
    Impact: Processing maliciously crafted web content may prevent
    Content Security Policy from being enforced. Description: An access
    issue existed in Content Security Policy.  This issue was addressed
    with improved access restrictions.

CVE-2020-9925
    Versions affected: WebKitGTK before 2.28.4 and WPE WebKit before 2.28.4
    Credit to an anonymous researcher.
    Impact: Processing maliciously crafted web content may lead to
    universal cross site scripting. Description: A logic issue was
    addressed with improved state management.


We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
Comment 1 OBSbugzilla Bot 2020-07-30 14:40:08 UTC 
This is an autogenerated message for OBS integration:
This bug (1174662) was mentioned in
https://build.opensuse.org/request/show/823594 Factory / webkit2gtk3
Comment 3 jun wang 2020-08-10 06:07:31 UTC 
I am testing webkit2gtk3 SUSE:Maintenance:15994:223646, I find a little issue when installing webkit2gtk3-devel:

"""
Problem: nothing provides pkgconfig(glib-2.0) needed by webkit2gtk3-devel-2.28.4-2.59.1.x86_64
 Solution 1: do not install webkit2gtk3-devel-2.28.4-2.59.1.x86_64
 Solution 2: break webkit2gtk3-devel-2.28.4-2.59.1.x86_64 by ignoring some of its dependencies
"""

this issue only happened on SLES12SP2.
openQA also detected this issue: https://openqa.suse.de/tests/overview?distri=sle&version=12-SP2&build=:15994:webkit2gtk3&groupid=53
Comment 4 jun wang 2020-08-11 13:33:11 UTC 
'pkgconfig(glib-2.0)' is provided by glib2-devel which is from SLE-SDK repo, after enabling SLE-SDK, I get this issue:

# zypper install libjavascriptcoregtk-4_0-18 libwebkit2gtk-4_0-37 libwebkit2gtk3-lang typelib-1_0-JavaScriptCore-4_0 typelib-1_0-WebKit2-4_0 typelib-1_0-WebKit2WebExtension-4_0 webkit2gtk-4_0-injected-bundles webkit2gtk3-devel
Building repository 'Testing' cache .............................................[done]
Loading repository data...
Reading installed packages...
Resolving package dependencies...

Problem: webkit2gtk3-devel-2.28.4-2.59.1.x86_64 requires pkgconfig(libsoup-2.4), but this requirement cannot be provided
  uninstallable providers: libsoup-devel-2.54.1-4.5.x86_64[sle-sdk::pool]
                   libsoup-devel-2.54.1-5.3.1.x86_64[sle-sdk::update]
 Solution 1: Following actions will be done:
  downgrade of libsoup-2_4-1-2.62.2-5.7.1.x86_64 to libsoup-2_4-1-2.54.1-5.3.1.x86_64
  downgrade of libsoup-lang-2.62.2-5.7.1.noarch to libsoup-lang-2.54.1-5.3.1.noarch
  downgrade of typelib-1_0-Soup-2_4-2.62.2-5.7.1.x86_64 to typelib-1_0-Soup-2_4-2.54.1-5.3.1.x86_64
 Solution 2: do not install webkit2gtk3-devel-2.28.4-2.59.1.x86_64
 Solution 3: break webkit2gtk3-devel-2.28.4-2.59.1.x86_64 by ignoring some of its dependencies

Choose from above solutions by number or cancel [1/2/3/c] (c): c


if want to install webkit2gtk3-devel, libsoup will be downgrade to libsoup-2_4-2.54.1, is this a serious issue?
Comment 5 Swamp Workflow Management 2020-08-11 16:15:40 UTC 
SUSE-SU-2020:2198-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1174662
CVE References: CVE-2020-9862,CVE-2020-9893,CVE-2020-9894,CVE-2020-9895,CVE-2020-9915,CVE-2020-9925
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    webkit2gtk3-2.28.4-3.60.1
SUSE Linux Enterprise Server 15-LTSS (src):    webkit2gtk3-2.28.4-3.60.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src):    webkit2gtk3-2.28.4-3.60.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    webkit2gtk3-2.28.4-3.60.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    webkit2gtk3-2.28.4-3.60.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    webkit2gtk3-2.28.4-3.60.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2020-08-11 16:17:37 UTC 
SUSE-SU-2020:2199-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1174662
CVE References: CVE-2020-9862,CVE-2020-9893,CVE-2020-9894,CVE-2020-9895,CVE-2020-9915,CVE-2020-9925
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src):    webkit2gtk3-2.28.4-3.6.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    webkit2gtk3-2.28.4-3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2020-08-13 13:15:08 UTC 
SUSE-SU-2020:2232-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1174662
CVE References: CVE-2020-9862,CVE-2020-9893,CVE-2020-9894,CVE-2020-9895,CVE-2020-9915,CVE-2020-9925
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE OpenStack Cloud Crowbar 8 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE OpenStack Cloud 9 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE OpenStack Cloud 8 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE OpenStack Cloud 7 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server 12-SP5 (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    webkit2gtk3-2.28.4-2.59.1
SUSE Enterprise Storage 5 (src):    webkit2gtk3-2.28.4-2.59.1
HPE Helion Openstack 8 (src):    webkit2gtk3-2.28.4-2.59.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Michael Gorse 2020-08-17 19:33:32 UTC 
(In reply to jun wang from comment #4)
> 'pkgconfig(glib-2.0)' is provided by glib2-devel which is from SLE-SDK repo,
> after enabling SLE-SDK, I get this issue:
> 
> # zypper install libjavascriptcoregtk-4_0-18 libwebkit2gtk-4_0-37
> libwebkit2gtk3-lang typelib-1_0-JavaScriptCore-4_0 typelib-1_0-WebKit2-4_0
> typelib-1_0-WebKit2WebExtension-4_0 webkit2gtk-4_0-injected-bundles
> webkit2gtk3-devel
> Building repository 'Testing' cache
> .............................................[done]
> Loading repository data...
> Reading installed packages...
> Resolving package dependencies...
> 
> Problem: webkit2gtk3-devel-2.28.4-2.59.1.x86_64 requires
> pkgconfig(libsoup-2.4), but this requirement cannot be provided
>   uninstallable providers: libsoup-devel-2.54.1-4.5.x86_64[sle-sdk::pool]
>                    libsoup-devel-2.54.1-5.3.1.x86_64[sle-sdk::update]
>  Solution 1: Following actions will be done:
>   downgrade of libsoup-2_4-1-2.62.2-5.7.1.x86_64 to
> libsoup-2_4-1-2.54.1-5.3.1.x86_64
>   downgrade of libsoup-lang-2.62.2-5.7.1.noarch to
> libsoup-lang-2.54.1-5.3.1.noarch
>   downgrade of typelib-1_0-Soup-2_4-2.62.2-5.7.1.x86_64 to
> typelib-1_0-Soup-2_4-2.54.1-5.3.1.x86_64
>  Solution 2: do not install webkit2gtk3-devel-2.28.4-2.59.1.x86_64
>  Solution 3: break webkit2gtk3-devel-2.28.4-2.59.1.x86_64 by ignoring some
> of its dependencies
> 
> Choose from above solutions by number or cancel [1/2/3/c] (c): c
> 
> 
> if want to install webkit2gtk3-devel, libsoup will be downgrade to
> libsoup-2_4-2.54.1, is this a serious issue?

Libsoup should not be downgraded to 2.54.1. Otherwise, WebKitGtk will not load.
Do you have the SLE workstation extension enabled?
Comment 9 Michael Gorse 2020-08-17 23:10:42 UTC 
(In reply to jun wang from comment #4)
> 'pkgconfig(glib-2.0)' is provided by glib2-devel which is from SLE-SDK repo,
> after enabling SLE-SDK, I get this issue:
> 
> # zypper install libjavascriptcoregtk-4_0-18 libwebkit2gtk-4_0-37
> libwebkit2gtk3-lang typelib-1_0-JavaScriptCore-4_0 typelib-1_0-WebKit2-4_0
> typelib-1_0-WebKit2WebExtension-4_0 webkit2gtk-4_0-injected-bundles
> webkit2gtk3-devel
> Building repository 'Testing' cache
> .............................................[done]
> Loading repository data...
> Reading installed packages...
> Resolving package dependencies...
> 
> Problem: webkit2gtk3-devel-2.28.4-2.59.1.x86_64 requires
> pkgconfig(libsoup-2.4), but this requirement cannot be provided
>   uninstallable providers: libsoup-devel-2.54.1-4.5.x86_64[sle-sdk::pool]
>                    libsoup-devel-2.54.1-5.3.1.x86_64[sle-sdk::update]
>  Solution 1: Following actions will be done:
>   downgrade of libsoup-2_4-1-2.62.2-5.7.1.x86_64 to
> libsoup-2_4-1-2.54.1-5.3.1.x86_64
>   downgrade of libsoup-lang-2.62.2-5.7.1.noarch to
> libsoup-lang-2.54.1-5.3.1.noarch
>   downgrade of typelib-1_0-Soup-2_4-2.62.2-5.7.1.x86_64 to
> typelib-1_0-Soup-2_4-2.54.1-5.3.1.x86_64
>  Solution 2: do not install webkit2gtk3-devel-2.28.4-2.59.1.x86_64
>  Solution 3: break webkit2gtk3-devel-2.28.4-2.59.1.x86_64 by ignoring some
> of its dependencies
> 
> Choose from above solutions by number or cancel [1/2/3/c] (c): c
> 
> 
> if want to install webkit2gtk3-devel, libsoup will be downgrade to
> libsoup-2_4-2.54.1, is this a serious issue?

Sorry; I just realized that I'd misread your comment.
We updated libsoup from 2.54.1 to 2.62.2, and it sounds as though the updated libsoup-devel package hasn't been pushed to sle-sdk::update.
Comment 10 Swamp Workflow Management 2020-08-24 22:16:48 UTC 
openSUSE-SU-2020:1256-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1174662
CVE References: CVE-2020-9862,CVE-2020-9893,CVE-2020-9894,CVE-2020-9895,CVE-2020-9915,CVE-2020-9925
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    webkit2gtk3-2.28.4-lp151.2.24.3
Comment 11 Alexandros Toptsoglou 2020-08-27 13:27:48 UTC 
Done
Comment 12 Swamp Workflow Management 2020-08-27 22:14:28 UTC 
openSUSE-SU-2020:1275-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1174662
CVE References: CVE-2020-9862,CVE-2020-9893,CVE-2020-9894,CVE-2020-9895,CVE-2020-9915,CVE-2020-9925
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    webkit2gtk3-2.28.4-lp152.2.4.3
First Last Prev Next    This bug is not in your last search results.