------------------------------------------------------------------------ WebKitGTK and WPE WebKit Security Advisory WSA-2024-0004 ------------------------------------------------------------------------
Date reported : August 17, 2024 Advisory ID : WSA-2024-0004 WebKitGTK Advisory URL : https://webkitgtk.org/security/WSA-2024-0004.html WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2024-0004.html CVE identifiers : CVE-2024-40776, CVE-2024-40779, CVE-2024-40780, CVE-2024-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794, CVE-2024-4558. Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2024-40776 Versions affected: WebKitGTK and WPE WebKit before 2.44.3. Credit to Huang Xilin of Ant Group Light-Year Security Lab. Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 273176 CVE-2024-40779 Versions affected: WebKitGTK and WPE WebKit before 2.44.3. Credit to Huang Xilin of Ant Group Light-Year Security Lab. Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: An out-of-bounds read was addressed with improved bounds checking. WebKit Bugzilla: 275431 CVE-2024-40780 Versions affected: WebKitGTK and WPE WebKit before 2.44.3. Credit to Huang Xilin of Ant Group Light-Year Security Lab. Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: An out-of-bounds read was addressed with improved bounds checking. WebKit Bugzilla: 275273 CVE-2024-40782 Versions affected: WebKitGTK and WPE WebKit before 2.44.3. Credit to Maksymilian Motyl. Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 268770 CVE-2024-40785 Versions affected: WebKitGTK and WPE WebKit before 2.44.3. Credit to Johan Carlsson (joaxcar). Impact: Processing maliciously crafted web content may lead to a cross site scripting attack. Description: This issue was addressed with improved checks. WebKit Bugzilla: 273805 CVE-2024-40789 Versions affected: WebKitGTK and WPE WebKit before 2.44.3. Credit to Seunghyun Lee (@0x10n) of KAIST Hacking Lab working with Trend Micro Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2024-40794 Versions affected: WebKitGTK and WPE WebKit before 2.44.3. Credit to Matthew Butler. Impact: Private Browsing tabs may be accessed without authentication. Description: This issue was addressed through improved state management. WebKit Bugzilla: 275272 CVE-2024-4558 Versions affected: WebKitGTK and WPE WebKit before 2.44.3. Credit to an anonymous researcher. Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: Use after free in ANGLE allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. WebKit Bugzilla: 274165 We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security. -- The WebKitGTK and WPE WebKit team.
signature.asc
Description: PGP signature
_______________________________________________ webkit-gtk mailing list webkit-gtk@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-gtk
