A webkit2gtk security update has been released for Arch Linux.

ASA-202007-1: webkit2gtk: multiple issues

Arch Linux Security Advisory ASA-202007-1
=========================================

Severity: Critical
Date : 2020-07-14
CVE-ID : CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9806
CVE-2020-9807 CVE-2020-9843 CVE-2020-9850 CVE-2020-13753
Package : webkit2gtk
Type : multiple issues
Remote : Yes
Link :   https://security.archlinux.org/AVG-1203

Summary
=======

The package webkit2gtk before version 2.28.3-1 is vulnerable to
multiple issues including arbitrary code execution, cross-site
scripting and sandbox escape.

Resolution
==========

Upgrade to 2.28.3-1.

# pacman -Syu "webkit2gtk>=2.28.3-1"

The problems have been fixed upstream in version 2.28.3.

Workaround
==========

None.

Description
===========

- CVE-2020-9802 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

- CVE-2020-9803 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

- CVE-2020-9805 (cross-site scripting)

A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, where processing maliciously crafted web content may
lead to universal cross site scripting.

- CVE-2020-9806 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

- CVE-2020-9807 (arbitrary code execution)

A memory corruption issue has been found in WebKitGTK before 2.28.3 and
WPE WebKit before 2.2.8.3, where processing maliciously crafted web
content may lead to arbitrary code execution.

- CVE-2020-9843 (cross-site scripting)

An issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, where processing maliciously crafted web content may
lead to a cross site scripting attack.

- CVE-2020-9850 (arbitrary code execution)

A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit
before 2.2.8.3, allowing a remote attacker to execute arbitrary code.

- CVE-2020-13753 (sandbox escape)

The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3,
failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl.
CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal,
which allows access outside the sandbox. TIOCSTI can be used to
directly execute commands outside the sandbox by writing to the
controlling terminal’s input buffer, similar to CVE-2017-5226.

Impact
======

A remote attacker might be able to trigger cross-site scripting, bypass
the sandbox and execute arbitrary code on the affected host.

References
==========

  https://webkitgtk.org/security/WSA-2020-0006.html
  https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9802
  https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9803
  https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9805
  https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9806
  https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9807
  https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9843
  https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9850
  https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-13753
  https://security.archlinux.org/CVE-2020-9802
  https://security.archlinux.org/CVE-2020-9803
  https://security.archlinux.org/CVE-2020-9805
  https://security.archlinux.org/CVE-2020-9806
  https://security.archlinux.org/CVE-2020-9807
  https://security.archlinux.org/CVE-2020-9843
  https://security.archlinux.org/CVE-2020-9850
  https://security.archlinux.org/CVE-2020-13753