Lucene search

K
nessusThis script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.FEDORA_2017-D317F6FB61.NASL
HistoryJan 23, 2017 - 12:00 a.m.

Fedora 24 : webkitgtk4 (2017-d317f6fb61)

2017-01-2300:00:00
This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
17

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.008

Percentile

81.6%

This update addresses the following vulnerabilities :

  • [CVE-2016-7656](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7656),     [CVE-2016-7635](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7635),     [CVE-2016-7654](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7654),     [CVE-2016-7639](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7639),     [CVE-2016-7645](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7645),     [CVE-2016-7652](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7652),     [CVE-2016-7641](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7641),     [CVE-2016-7632](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7632),     [CVE-2016-7599](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7599),     [CVE-2016-7592](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7592),     [CVE-2016-7589](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7589),     [CVE-2016-7623](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7623),     [CVE-2016-7586](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7586)
    

Additional fixes :

  • Create GLX OpenGL contexts using version 3.2 (core profile) when available to reduce the memory consumption on Mesa based drivers.

  • Improve memory pressure handler to reduce the CPU usage on memory pressure situations.

  • Fix a regression in WebKitWebView title notify signal emission that caused the signal to be emitted multiple times.

  • Fix high CPU usage in the web process loading hyphenation dictionaries. More user agent string improvements to improve compatibility with several websites.

  • Fix web process crash when closing the web view in X11.

  • Fix the build with OpenGL ES2 enabled.

  • Fix several crashes and rendering issues.

Translation updates :

  • German.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2017-d317f6fb61.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(96680);
  script_version("3.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/06");

  script_cve_id("CVE-2016-7586", "CVE-2016-7589", "CVE-2016-7592", "CVE-2016-7599", "CVE-2016-7623", "CVE-2016-7632", "CVE-2016-7635", "CVE-2016-7639", "CVE-2016-7641", "CVE-2016-7645", "CVE-2016-7652", "CVE-2016-7654", "CVE-2016-7656");
  script_xref(name:"FEDORA", value:"2017-d317f6fb61");

  script_name(english:"Fedora 24 : webkitgtk4 (2017-d317f6fb61)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update addresses the following vulnerabilities :

  -
    [CVE-2016-7656](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7656),
    [CVE-2016-7635](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7635),
    [CVE-2016-7654](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7654),
    [CVE-2016-7639](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7639),
    [CVE-2016-7645](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7645),
    [CVE-2016-7652](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7652),
    [CVE-2016-7641](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7641),
    [CVE-2016-7632](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7632),
    [CVE-2016-7599](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7599),
    [CVE-2016-7592](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7592),
    [CVE-2016-7589](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7589),
    [CVE-2016-7623](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7623),
    [CVE-2016-7586](https://cve.mitre.org/cgi-bin/cvename.cg
    i?name=CVE-2016-7586)

Additional fixes :

  - Create GLX OpenGL contexts using version 3.2 (core
    profile) when available to reduce the memory consumption
    on Mesa based drivers.

  - Improve memory pressure handler to reduce the CPU usage
    on memory pressure situations.

  - Fix a regression in WebKitWebView title notify signal
    emission that caused the signal to be emitted multiple
    times.

  - Fix high CPU usage in the web process loading
    hyphenation dictionaries. More user agent string
    improvements to improve compatibility with several
    websites.

  - Fix web process crash when closing the web view in X11.

  - Fix the build with OpenGL ES2 enabled.

  - Fix several crashes and rendering issues.

Translation updates :

  - German.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-d317f6fb61"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected webkitgtk4 package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:webkitgtk4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:24");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/02/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/01/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/01/23");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^24([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 24", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC24", reference:"webkitgtk4-2.14.3-1.fc24")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "webkitgtk4");
}

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.008

Percentile

81.6%