[wpe-webkit] WebKitGTK and WPE WebKit Security Advisory WSA-2024-0004

[Adrian Perez de Castro]

------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory                 WSA-2024-0004
------------------------------------------------------------------------

Date reported           : August 17, 2024
Advisory ID             : WSA-2024-0004
WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2024-0004.html
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2024-0004.html
CVE identifiers         : CVE-2024-40776, CVE-2024-40779,
                          CVE-2024-40780, CVE-2024-40782,
                          CVE-2024-40785, CVE-2024-40789,
                          CVE-2024-40794, CVE-2024-4558.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2024-40776
    Versions affected: WebKitGTK and WPE WebKit before 2.44.3.
    Credit to Huang Xilin of Ant Group Light-Year Security Lab.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected process crash. Description: A use-after-free issue was
    addressed with improved memory management.
    WebKit Bugzilla: 273176

CVE-2024-40779
    Versions affected: WebKitGTK and WPE WebKit before 2.44.3.
    Credit to Huang Xilin of Ant Group Light-Year Security Lab.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected process crash. Description: An out-of-bounds read was
    addressed with improved bounds checking.
    WebKit Bugzilla: 275431

CVE-2024-40780
    Versions affected: WebKitGTK and WPE WebKit before 2.44.3.
    Credit to Huang Xilin of Ant Group Light-Year Security Lab.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected process crash. Description: An out-of-bounds read was
    addressed with improved bounds checking.
    WebKit Bugzilla: 275273

CVE-2024-40782
    Versions affected: WebKitGTK and WPE WebKit before 2.44.3.
    Credit to Maksymilian Motyl.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected process crash. Description: A use-after-free issue was
    addressed with improved memory management.
    WebKit Bugzilla: 268770

CVE-2024-40785
    Versions affected: WebKitGTK and WPE WebKit before 2.44.3.
    Credit to Johan Carlsson (joaxcar).
    Impact: Processing maliciously crafted web content may lead to a
    cross site scripting attack. Description: This issue was addressed
    with improved checks.
    WebKit Bugzilla: 273805

CVE-2024-40789
    Versions affected: WebKitGTK and WPE WebKit before 2.44.3.
    Credit to Seunghyun Lee (@0x10n) of KAIST Hacking Lab working with Trend Micro
    Zero Day Initiative.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected process crash. Description: An out-of-bounds access issue
    was addressed with improved bounds checking.
    

CVE-2024-40794
    Versions affected: WebKitGTK and WPE WebKit before 2.44.3.
    Credit to Matthew Butler.
    Impact: Private Browsing tabs may be accessed without
    authentication. Description: This issue was addressed through
    improved state management.
    WebKit Bugzilla: 275272

CVE-2024-4558
    Versions affected: WebKitGTK and WPE WebKit before 2.44.3.
    Credit to an anonymous researcher.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected process crash. Description: Use after free in ANGLE
    allowed a remote attacker to potentially exploit heap corruption via
    a crafted HTML page.
    WebKit Bugzilla: 274165

We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security.

--
The WebKitGTK and WPE WebKit team.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <http://lists.webkit.org/pipermail/webkit-wpe/attachments/20240817/f1083ea2/attachment.bin>