Alerts This Week
Warning Icon 1 700
Alerts This Week
Warning Icon 1 700

Gentoo GLSA 201601-02 Normal: WebKitGTK+ Code Issues and DoS

gentoo
Calendar Grey January 26, 2016
Dist Gentoo Esm H88
Several security flaws identified in WebKitGTK+, posing risks for remote code execution and denial of service attacks. Immediate upgrading is advised for enhanced protection.
Multiple vulnerabilities have been found in WebKitGTK+, allowing remote attackers to execute arbitrary code or cause a Denial of Service condition

Summary

Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the CVE identifiers referenced below for details.

Topics%20covered

Topics Covered

security advisory Gentoo remote code execution DoS threat code issues normal severity WebKitGTK+

Resolution

All WebKitGTK+ 3 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.4.9:3"
All WebKitGTK+ 2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=net-libs/webkit-gtk-2.4.9-r200:2"

References

[ 1 ] CVE-2014-1344 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1344 [ 2 ] CVE-2014-1384 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1384 [ 3 ] CVE-2014-1385 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1385 [ 4 ] CVE-2014-1386 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1386 [ 5 ] CVE-2014-1387 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1387 [ 6 ] CVE-2014-1388 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1388 [ 7 ] CVE-2014-1389 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1389 [ 8 ] CVE-2014-1390 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1390

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201601-02
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: WebKitGTK+: Multiple vulnerabilities
Date: January 26, 2016
Bugs: #536234
ID: 201601-02

Topics%20covered

Topics Covered

security advisory Gentoo remote code execution DoS threat code issues normal severity WebKitGTK+

Synopsis

Multiple vulnerabilities have been found in WebKitGTK+, allowing remote attackers to execute arbitrary code or cause a Denial of Service condition.

Background

WebKitGTK+ is a full-featured port of the WebKit rendering engine.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/webkit-gtk < 2.4.9 >= 2.4.9

Impact

===== A remote attack can use multiple vectors to execute arbitrary code or cause a denial of service condition.

Workaround

There is no known workaround at this time.

Related News

Your message here