WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0006

• Date Reported: August 07, 2018

• Advisory ID: WSA-2018-0006

• CVE identifiers: CVE-2018-4246, CVE-2018-4261, CVE-2018-4262, CVE-2018-4263, CVE-2018-4264, CVE-2018-4265, CVE-2018-4266, CVE-2018-4267, CVE-2018-4270, CVE-2018-4271, CVE-2018-4272, CVE-2018-4273, CVE-2018-4278, CVE-2018-4284, CVE-2018-12911.

Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.

• CVE-2018-4246

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.1.
  • Credit to OSS-Fuzz.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.

• CVE-2018-4261

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to Omair working with Trend Micro’s Zero Day Initiative.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

• CVE-2018-4262

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to Mateusz Krzywicki working with Trend Micro’s Zero Day Initiative.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

• CVE-2018-4263

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to Arayz working with Trend Micro’s Zero Day Initiative.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

• CVE-2018-4264

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to OSS-Fuzz, Yu Zhou and Jundong Xie of Ant-financial Light- Year Security Lab.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

• CVE-2018-4265

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to cc working with Trend Micro’s Zero Day Initiative.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

• CVE-2018-4266

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to OSS-Fuzz.
  • A malicious website may be able to cause a denial of service. A race condition was addressed with additional validation.

• CVE-2018-4267

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to Arayz of Pangu team working with Trend Micro’s Zero Day Initiative.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

• CVE-2018-4270

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to OSS-Fuzz.
  • Processing maliciously crafted web content may lead to an unexpected application crash. A memory corruption issue was addressed with improved memory handling.

• CVE-2018-4271

  • Versions affected: WebKitGTK+ before 2.20.2.
  • Credit to OSS-Fuzz.
  • Processing maliciously crafted web content may lead to an unexpected application crash. A memory corruption issue was addressed with improved input validation.

• CVE-2018-4272

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to OSS-Fuzz.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

• CVE-2018-4273

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to OSS-Fuzz.
  • Processing maliciously crafted web content may lead to an unexpected application crash. A memory corruption issue was addressed with improved input validation.

• CVE-2018-4278

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to Jun Kokatsu (@shhnjk).
  • A malicious website may exfiltrate audio data cross-origin. Sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.

• CVE-2018-4284

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to OSS-Fuzz.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.

• CVE-2018-12911

  • Versions affected: WebKitGTK+ before 2.20.4 and WPE WebKit before 2.20.2.
  • Credit to Yu Haiwan.
  • Processing maliciously crafted web content may lead to arbitrary code execution. A buffer overflow issue was addressed with improved memory handling.

We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.

Further information about WebKitGTK+ and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/.