WebKitGTK and WPE WebKit Security Advisory WSA-2021-0002

[Carlos Alberto Lopez Perez <clopez igalia com>]

------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory                 WSA-2021-0002
------------------------------------------------------------------------

Date reported           : March 22, 2021
Advisory ID             : WSA-2021-0002
WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2021-0002.html
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2021-0002.html
CVE identifiers         : CVE-2020-27918, CVE-2020-29623, CVE-2020-9947,
                          CVE-2021-1765, CVE-2021-1789, CVE-2021-1799,
                          CVE-2021-1801, CVE-2021-1870.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2020-27918
    Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.
    Credit to Liu Long of Ant Security Light-Year Lab.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: A use after free issue was
    addressed with improved memory management.

CVE-2020-29623
    Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.
    Credit to Simon Hunt of OvalTwo LTD.
    Impact: A user may be unable to fully delete browsing history.
    Description: "Clear History and Website Data" did not clear the
    history in some circumstances. The issue was addressed with improved
    data deletion.

CVE-2020-9947
    Versions affected: WebKitGTK before 2.30.0 and WPE WebKit before 2.30.0.
    Credit to cc working with Trend Micro Zero Day Initiative.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: A use after free issue was
    addressed with improved memory management.

CVE-2021-1765
    Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.
    Credit to Eliya Stein of Confiant.
    Impact: Maliciously crafted web content may violate iframe
    sandboxing policy. Description: This issue was addressed with
    improved iframe sandbox enforcement.

CVE-2021-1789
    Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.
    Credit to @S0rryMybad of 360 Vulcan Team.
    Impact: Processing maliciously crafted web content may lead to
    arbitrary code execution. Description: A type confusion issue was
    addressed with improved state handling.

CVE-2021-1799
    Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.
    Credit to Gregory Vishnepolsky & Ben Seri of Armis Security, and
    Samy Kamkar.
    Impact: A malicious website may be able to access restricted ports
    on arbitrary servers, Description: A port redirection issue was
    addressed with additional port validation.

CVE-2021-1801
    Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.
    Credit to Eliya Stein of Confiant.
    Impact: Maliciously crafted web content may violate iframe
    sandboxing policy. Description: This issue was addressed with
    improved iframe sandbox enforcement.

CVE-2021-1870
    Versions affected: WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6.
    Credit to an anonymous researcher.
    Impact: A remote attacker may be able to cause arbitrary code
    execution. Apple is aware of a report that this issue may have been
    actively exploited. Description: A logic issue was addressed with
    improved restrictions.


We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.

The WebKitGTK and WPE WebKit team,
March 22, 2021