This update for webkit2gtk3 fixes the following issues: Update to version 2.18.5 :
Disable SharedArrayBuffers from Web API.
Reduce the precision of ‘high’ resolution time to 1ms.
bsc#1075419 - Security fixes: includes improvements to mitigate the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715). Update to version 2.18.4 :
Make WebDriver implementation more spec compliant.
Fix a bug when trying to remove cookies before a web process is spawned.
WebKitWebDriver process no longer links to libjavascriptcoregtk.
Fix several memory leaks in GStreamer media backend.
bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to version 2.18.3 :
Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases.
Fix handling of null capabilities in WebDriver implementation.
Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803. Update to version 2.18.2 :
Fix rendering of arabic text.
Fix a crash in the web process when decoding GIF images.
Fix rendering of wind in Windy.com.
Fix several crashes and rendering issues. Update to version 2.18.1 :
Improve performance of GIF animations.
Fix garbled display in GMail.
Fix rendering of several material design icons when using the web font.
Fix flickering when resizing the window in Wayland.
Prevent default kerberos authentication credentials from being used in ephemeral sessions.
Fix a crash when webkit_web_resource_get_data() is cancelled.
Correctly handle touchmove and touchend events in WebKitWebView.
Fix the build with enchant 2.1.1.
Fix the build in HPPA and Alpha.
Fix several crashes and rendering issues.
Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142.
Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2018:0219-1.
# The text itself is copyright (C) SUSE.
#
include("compat.inc");
if (description)
{
script_id(106370);
script_version("3.8");
script_cvs_date("Date: 2019/09/10 13:51:46");
script_cve_id("CVE-2016-4692", "CVE-2016-4743", "CVE-2016-7586", "CVE-2016-7587", "CVE-2016-7589", "CVE-2016-7592", "CVE-2016-7598", "CVE-2016-7599", "CVE-2016-7610", "CVE-2016-7623", "CVE-2016-7632", "CVE-2016-7635", "CVE-2016-7639", "CVE-2016-7641", "CVE-2016-7645", "CVE-2016-7652", "CVE-2016-7654", "CVE-2016-7656", "CVE-2017-13788", "CVE-2017-13798", "CVE-2017-13803", "CVE-2017-13856", "CVE-2017-13866", "CVE-2017-13870", "CVE-2017-2350", "CVE-2017-2354", "CVE-2017-2355", "CVE-2017-2356", "CVE-2017-2362", "CVE-2017-2363", "CVE-2017-2364", "CVE-2017-2365", "CVE-2017-2366", "CVE-2017-2369", "CVE-2017-2371", "CVE-2017-2373", "CVE-2017-2496", "CVE-2017-2510", "CVE-2017-2539", "CVE-2017-5715", "CVE-2017-5753", "CVE-2017-5754", "CVE-2017-7006", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7059", "CVE-2017-7061", "CVE-2017-7064", "CVE-2017-7081", "CVE-2017-7087", "CVE-2017-7089", "CVE-2017-7090", "CVE-2017-7091", "CVE-2017-7092", "CVE-2017-7093", "CVE-2017-7094", "CVE-2017-7095", "CVE-2017-7096", "CVE-2017-7098", "CVE-2017-7099", "CVE-2017-7100", "CVE-2017-7102", "CVE-2017-7104", "CVE-2017-7107", "CVE-2017-7109", "CVE-2017-7111", "CVE-2017-7117", "CVE-2017-7120", "CVE-2017-7142", "CVE-2017-7156", "CVE-2017-7157");
script_xref(name:"IAVA", value:"2018-A-0019");
script_xref(name:"IAVA", value:"2018-A-0020");
script_name(english:"SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2018:0219-1) (Meltdown) (Spectre)");
script_summary(english:"Checks rpm output for the updated packages.");
script_set_attribute(
attribute:"synopsis",
value:"The remote SUSE host is missing one or more security updates."
);
script_set_attribute(
attribute:"description",
value:
"This update for webkit2gtk3 fixes the following issues: Update to
version 2.18.5 :
+ Disable SharedArrayBuffers from Web API.
+ Reduce the precision of 'high' resolution time to 1ms.
+ bsc#1075419 - Security fixes: includes improvements to
mitigate the effects of Spectre and Meltdown
(CVE-2017-5753 and CVE-2017-5715). Update to version
2.18.4 :
+ Make WebDriver implementation more spec compliant.
+ Fix a bug when trying to remove cookies before a web
process is spawned.
+ WebKitWebDriver process no longer links to
libjavascriptcoregtk.
+ Fix several memory leaks in GStreamer media backend.
+ bsc#1073654 - Security fixes: CVE-2017-13866,
CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to
version 2.18.3 :
+ Improve calculation of font metrics to prevent
scrollbars from being shown unnecessarily in some cases.
+ Fix handling of null capabilities in WebDriver
implementation.
+ Security fixes: CVE-2017-13798, CVE-2017-13788,
CVE-2017-13803. Update to version 2.18.2 :
+ Fix rendering of arabic text.
+ Fix a crash in the web process when decoding GIF images.
+ Fix rendering of wind in Windy.com.
+ Fix several crashes and rendering issues. Update to
version 2.18.1 :
+ Improve performance of GIF animations.
+ Fix garbled display in GMail.
+ Fix rendering of several material design icons when
using the web font.
+ Fix flickering when resizing the window in Wayland.
+ Prevent default kerberos authentication credentials from
being used in ephemeral sessions.
+ Fix a crash when webkit_web_resource_get_data() is
cancelled.
+ Correctly handle touchmove and touchend events in
WebKitWebView.
+ Fix the build with enchant 2.1.1.
+ Fix the build in HPPA and Alpha.
+ Fix several crashes and rendering issues.
+ Security fixes: CVE-2017-7081, CVE-2017-7087,
CVE-2017-7089, CVE-2017-7090, CVE-2017-7091,
CVE-2017-7092, CVE-2017-7093, CVE-2017-7094,
CVE-2017-7095, CVE-2017-7096, CVE-2017-7098,
CVE-2017-7099, CVE-2017-7100, CVE-2017-7102,
CVE-2017-7104, CVE-2017-7107, CVE-2017-7109,
CVE-2017-7111, CVE-2017-7117, CVE-2017-7120,
CVE-2017-7142.
- Enable gold linker on s390/s390x on SLE15/Tumbleweed.
Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1020950"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1024749"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1050469"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1066892"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1069925"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1073654"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1075419"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-4692/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-4743/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7586/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7587/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7589/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7592/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7598/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7599/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7610/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7623/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7632/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7635/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7639/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7641/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7645/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7652/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7654/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-7656/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-13788/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-13798/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-13803/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-13856/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-13866/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-13870/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2350/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2354/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2355/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2356/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2362/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2363/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2364/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2365/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2366/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2369/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2371/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2373/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2496/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2510/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-2539/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-5715/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-5753/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-5754/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7006/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7011/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7012/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7018/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7019/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7020/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7030/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7034/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7037/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7038/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7039/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7040/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7041/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7042/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7043/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7046/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7048/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7049/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7052/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7055/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7056/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7059/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7061/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7064/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7081/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7087/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7089/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7090/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7091/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7092/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7093/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7094/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7095/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7096/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7098/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7099/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7100/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7102/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7104/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7107/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7109/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7111/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7117/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7120/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7142/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7156/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-7157/"
);
# https://www.suse.com/support/update/announcement/2018/suse-su-20180219-1/
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?df2168e5"
);
script_set_attribute(
attribute:"solution",
value:
"To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :
SUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch
SUSE-SLE-WE-12-SP3-2018-150=1
SUSE Linux Enterprise Workstation Extension 12-SP2:zypper in -t patch
SUSE-SLE-WE-12-SP2-2018-150=1
SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
patch SUSE-SLE-SDK-12-SP3-2018-150=1
SUSE Linux Enterprise Software Development Kit 12-SP2:zypper in -t
patch SUSE-SLE-SDK-12-SP2-2018-150=1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2:zypper in -t
patch SUSE-SLE-RPI-12-SP2-2018-150=1
SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
SUSE-SLE-SERVER-12-SP3-2018-150=1
SUSE Linux Enterprise Server 12-SP2:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-2018-150=1
SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP3-2018-150=1
SUSE Linux Enterprise Desktop 12-SP2:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP2-2018-150=1
To bring your system up-to-date, use 'zypper patch'."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
script_set_attribute(attribute:"canvas_package", value:'CANVAS');
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18-debuginfo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37-debuginfo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:typelib-1_0-JavaScriptCore");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:typelib-1_0-WebKit2");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles-debuginfo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:webkit2gtk3-debugsource");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
script_set_attribute(attribute:"vuln_publication_date", value:"2017/02/20");
script_set_attribute(attribute:"patch_publication_date", value:"2018/01/25");
script_set_attribute(attribute:"plugin_publication_date", value:"2018/01/26");
script_set_attribute(attribute:"in_the_news", value:"true");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"SuSE Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(2|3)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP2/3", os_ver + " SP" + sp);
if (os_ver == "SLED12" && (! preg(pattern:"^(2|3)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP2/3", os_ver + " SP" + sp);
flag = 0;
if (rpm_check(release:"SLES12", sp:"3", reference:"libjavascriptcoregtk-4_0-18-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libwebkit2gtk-4_0-37-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"typelib-1_0-WebKit2-4_0-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"webkit2gtk3-debugsource-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libjavascriptcoregtk-4_0-18-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libwebkit2gtk-4_0-37-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"typelib-1_0-WebKit2-4_0-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"webkit2gtk3-debugsource-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libjavascriptcoregtk-4_0-18-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libwebkit2gtk-4_0-37-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"typelib-1_0-WebKit2-4_0-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"webkit2gtk3-debugsource-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"libjavascriptcoregtk-4_0-18-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"libwebkit2gtk-4_0-37-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"typelib-1_0-WebKit2-4_0-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1")) flag++;
if (rpm_check(release:"SLED12", sp:"2", cpu:"x86_64", reference:"webkit2gtk3-debugsource-2.18.5-2.18.1")) flag++;
if (flag)
{
if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
else security_hole(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "webkit2gtk3");
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4692
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4743
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7586
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7587
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7589
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7592
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7598
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7599
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7610
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7623
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7632
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7635
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7639
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7641
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7645
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7652
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7654
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7656
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13788
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13798
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13803
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13856
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13866
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13870
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2350
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2354
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2355
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2356
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2362
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2363
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2364
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2365
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2366
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2369
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2371
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2373
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2496
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2510
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2539
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5753
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7081
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7087
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7089
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7090
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7091
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7092
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7093
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7094
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7095
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7096
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7098
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7099
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7100
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7102
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7104
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7107
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7109
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7111
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7117
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7120
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7142
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7156
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7157
www.nessus.org/u?df2168e5
bugzilla.suse.com/show_bug.cgi?id=1020950
bugzilla.suse.com/show_bug.cgi?id=1024749
bugzilla.suse.com/show_bug.cgi?id=1050469
bugzilla.suse.com/show_bug.cgi?id=1066892
bugzilla.suse.com/show_bug.cgi?id=1069925
bugzilla.suse.com/show_bug.cgi?id=1073654
bugzilla.suse.com/show_bug.cgi?id=1075419
www.suse.com/security/cve/CVE-2016-4692/
www.suse.com/security/cve/CVE-2016-4743/
www.suse.com/security/cve/CVE-2016-7586/
www.suse.com/security/cve/CVE-2016-7587/
www.suse.com/security/cve/CVE-2016-7589/
www.suse.com/security/cve/CVE-2016-7592/
www.suse.com/security/cve/CVE-2016-7598/
www.suse.com/security/cve/CVE-2016-7599/
www.suse.com/security/cve/CVE-2016-7610/
www.suse.com/security/cve/CVE-2016-7623/
www.suse.com/security/cve/CVE-2016-7632/
www.suse.com/security/cve/CVE-2016-7635/
www.suse.com/security/cve/CVE-2016-7639/
www.suse.com/security/cve/CVE-2016-7641/
www.suse.com/security/cve/CVE-2016-7645/
www.suse.com/security/cve/CVE-2016-7652/
www.suse.com/security/cve/CVE-2016-7654/
www.suse.com/security/cve/CVE-2016-7656/
www.suse.com/security/cve/CVE-2017-13788/
www.suse.com/security/cve/CVE-2017-13798/
www.suse.com/security/cve/CVE-2017-13803/
www.suse.com/security/cve/CVE-2017-13856/
www.suse.com/security/cve/CVE-2017-13866/
www.suse.com/security/cve/CVE-2017-13870/
www.suse.com/security/cve/CVE-2017-2350/
www.suse.com/security/cve/CVE-2017-2354/
www.suse.com/security/cve/CVE-2017-2355/
www.suse.com/security/cve/CVE-2017-2356/
www.suse.com/security/cve/CVE-2017-2362/
www.suse.com/security/cve/CVE-2017-2363/
www.suse.com/security/cve/CVE-2017-2364/
www.suse.com/security/cve/CVE-2017-2365/
www.suse.com/security/cve/CVE-2017-2366/
www.suse.com/security/cve/CVE-2017-2369/
www.suse.com/security/cve/CVE-2017-2371/
www.suse.com/security/cve/CVE-2017-2373/
www.suse.com/security/cve/CVE-2017-2496/
www.suse.com/security/cve/CVE-2017-2510/
www.suse.com/security/cve/CVE-2017-2539/
www.suse.com/security/cve/CVE-2017-5715/
www.suse.com/security/cve/CVE-2017-5753/
www.suse.com/security/cve/CVE-2017-5754/
www.suse.com/security/cve/CVE-2017-7006/
www.suse.com/security/cve/CVE-2017-7011/
www.suse.com/security/cve/CVE-2017-7012/
www.suse.com/security/cve/CVE-2017-7018/
www.suse.com/security/cve/CVE-2017-7019/
www.suse.com/security/cve/CVE-2017-7020/
www.suse.com/security/cve/CVE-2017-7030/
www.suse.com/security/cve/CVE-2017-7034/
www.suse.com/security/cve/CVE-2017-7037/
www.suse.com/security/cve/CVE-2017-7038/
www.suse.com/security/cve/CVE-2017-7039/
www.suse.com/security/cve/CVE-2017-7040/
www.suse.com/security/cve/CVE-2017-7041/
www.suse.com/security/cve/CVE-2017-7042/
www.suse.com/security/cve/CVE-2017-7043/
www.suse.com/security/cve/CVE-2017-7046/
www.suse.com/security/cve/CVE-2017-7048/
www.suse.com/security/cve/CVE-2017-7049/
www.suse.com/security/cve/CVE-2017-7052/
www.suse.com/security/cve/CVE-2017-7055/
www.suse.com/security/cve/CVE-2017-7056/
www.suse.com/security/cve/CVE-2017-7059/
www.suse.com/security/cve/CVE-2017-7061/
www.suse.com/security/cve/CVE-2017-7064/
www.suse.com/security/cve/CVE-2017-7081/
www.suse.com/security/cve/CVE-2017-7087/
www.suse.com/security/cve/CVE-2017-7089/
www.suse.com/security/cve/CVE-2017-7090/
www.suse.com/security/cve/CVE-2017-7091/
www.suse.com/security/cve/CVE-2017-7092/
www.suse.com/security/cve/CVE-2017-7093/
www.suse.com/security/cve/CVE-2017-7094/
www.suse.com/security/cve/CVE-2017-7095/
www.suse.com/security/cve/CVE-2017-7096/
www.suse.com/security/cve/CVE-2017-7098/
www.suse.com/security/cve/CVE-2017-7099/
www.suse.com/security/cve/CVE-2017-7100/
www.suse.com/security/cve/CVE-2017-7102/
www.suse.com/security/cve/CVE-2017-7104/
www.suse.com/security/cve/CVE-2017-7107/
www.suse.com/security/cve/CVE-2017-7109/
www.suse.com/security/cve/CVE-2017-7111/
www.suse.com/security/cve/CVE-2017-7117/
www.suse.com/security/cve/CVE-2017-7120/
www.suse.com/security/cve/CVE-2017-7142/
www.suse.com/security/cve/CVE-2017-7156/
www.suse.com/security/cve/CVE-2017-7157/