Arch Linux Security Advisory ASA-202007-1

Severity: Critical
Date : 2020-07-14
CVE-ID : CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9806
CVE-2020-9807 CVE-2020-9843 CVE-2020-9850 CVE-2020-13753
Package : webkit2gtk
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1203

Summary

The package webkit2gtk before version 2.28.3-1 is vulnerable to
multiple issues including arbitrary code execution, cross-site
scripting and sandbox escape.

Resolution

Upgrade to 2.28.3-1.

pacman -Syu “webkit2gtk>=2.28.3-1”

The problems have been fixed upstream in version 2.28.3.

Workaround

None.

Description

• CVE-2020-9802 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

• CVE-2020-9803 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

• CVE-2020-9805 (cross-site scripting)

A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, where processing maliciously crafted web content may
lead to universal cross site scripting.

• CVE-2020-9806 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

• CVE-2020-9807 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

• CVE-2020-9843 (cross-site scripting)

An issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, where processing maliciously crafted web content may
lead to a cross site scripting attack.

• CVE-2020-9850 (arbitrary code execution)

A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, allowing a remote attacker to execute arbitrary code.

• CVE-2020-13753 (sandbox escape)

The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3,
failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl.
CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal,
which allows access outside the sandbox. TIOCSTI can be used to
directly execute commands outside the sandbox by writing to the
controlling terminal’s input buffer, similar to CVE-2017-5226.

Impact

A remote attacker might be able to trigger cross-site scripting, bypass
the sandbox and execute arbitrary code on the affected host.

References

https://webkitgtk.org/security/WSA-2020-0006.html
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9802
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9803
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9805
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9806
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9807
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9843
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9850
https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-13753
https://security.archlinux.org/CVE-2020-9802
https://security.archlinux.org/CVE-2020-9803
https://security.archlinux.org/CVE-2020-9805
https://security.archlinux.org/CVE-2020-9806
https://security.archlinux.org/CVE-2020-9807
https://security.archlinux.org/CVE-2020-9843
https://security.archlinux.org/CVE-2020-9850
https://security.archlinux.org/CVE-2020-13753