Sigurnosni nedostaci programskog paketa webkit2gtk3

SUSE Security Update: Security update for webkit2gtk3
______________________________________________________________________________

Announcement ID: SUSE-SU-2018:0219-1
Rating: important
References: #1020950 #1024749 #1050469 #1066892 #1069925
#1073654 #1075419
Cross-References: CVE-2016-4692 CVE-2016-4743 CVE-2016-7586
CVE-2016-7587 CVE-2016-7589 CVE-2016-7592
CVE-2016-7598 CVE-2016-7599 CVE-2016-7610
CVE-2016-7623 CVE-2016-7632 CVE-2016-7635
CVE-2016-7639 CVE-2016-7641 CVE-2016-7645
CVE-2016-7652 CVE-2016-7654 CVE-2016-7656
CVE-2017-13788 CVE-2017-13798 CVE-2017-13803
CVE-2017-13856 CVE-2017-13866 CVE-2017-13870
CVE-2017-2350 CVE-2017-2354 CVE-2017-2355
CVE-2017-2356 CVE-2017-2362 CVE-2017-2363
CVE-2017-2364 CVE-2017-2365 CVE-2017-2366
CVE-2017-2369 CVE-2017-2371 CVE-2017-2373
CVE-2017-2496 CVE-2017-2510 CVE-2017-2539
CVE-2017-5715 CVE-2017-5753 CVE-2017-5754
CVE-2017-7006 CVE-2017-7011 CVE-2017-7012
CVE-2017-7018 CVE-2017-7019 CVE-2017-7020
CVE-2017-7030 CVE-2017-7034 CVE-2017-7037
CVE-2017-7038 CVE-2017-7039 CVE-2017-7040
CVE-2017-7041 CVE-2017-7042 CVE-2017-7043
CVE-2017-7046 CVE-2017-7048 CVE-2017-7049
CVE-2017-7052 CVE-2017-7055 CVE-2017-7056
CVE-2017-7059 CVE-2017-7061 CVE-2017-7064
CVE-2017-7081 CVE-2017-7087 CVE-2017-7089
CVE-2017-7090 CVE-2017-7091 CVE-2017-7092
CVE-2017-7093 CVE-2017-7094 CVE-2017-7095
CVE-2017-7096 CVE-2017-7098 CVE-2017-7099
CVE-2017-7100 CVE-2017-7102 CVE-2017-7104
CVE-2017-7107 CVE-2017-7109 CVE-2017-7111
CVE-2017-7117 CVE-2017-7120 CVE-2017-7142
CVE-2017-7156 CVE-2017-7157
Affected Products:
SUSE Linux Enterprise Workstation Extension 12-SP3
SUSE Linux Enterprise Workstation Extension 12-SP2
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Software Development Kit 12-SP2
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2
SUSE Linux Enterprise Server 12-SP3
SUSE Linux Enterprise Server 12-SP2
SUSE Linux Enterprise Desktop 12-SP3
SUSE Linux Enterprise Desktop 12-SP2
______________________________________________________________________________

An update that fixes 89 vulnerabilities is now available.

Description:

This update for webkit2gtk3 fixes the following issues:

Update to version 2.18.5:

+ Disable SharedArrayBuffers from Web API.
+ Reduce the precision of “high” resolution time to 1ms.
+ bsc#1075419 – Security fixes: includes improvements to mitigate the
effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715).

Update to version 2.18.4:

+ Make WebDriver implementation more spec compliant.
+ Fix a bug when trying to remove cookies before a web process is
spawned.
+ WebKitWebDriver process no longer links to libjavascriptcoregtk.
+ Fix several memory leaks in GStreamer media backend.
+ bsc#1073654 – Security fixes: CVE-2017-13866, CVE-2017-13870,
CVE-2017-7156, CVE-2017-13856.

Update to version 2.18.3:

+ Improve calculation of font metrics to prevent scrollbars from being
shown unnecessarily in some cases.
+ Fix handling of null capabilities in WebDriver implementation.
+ Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803.

Update to version 2.18.2:

+ Fix rendering of arabic text.
+ Fix a crash in the web process when decoding GIF images.
+ Fix rendering of wind in Windy.com.
+ Fix several crashes and rendering issues.

Update to version 2.18.1:

+ Improve performance of GIF animations.
+ Fix garbled display in GMail.
+ Fix rendering of several material design icons when using the web font.
+ Fix flickering when resizing the window in Wayland.
+ Prevent default kerberos authentication credentials from being used in
ephemeral sessions.
+ Fix a crash when webkit_web_resource_get_data() is cancelled.
+ Correctly handle touchmove and touchend events in WebKitWebView.
+ Fix the build with enchant 2.1.1.
+ Fix the build in HPPA and Alpha.
+ Fix several crashes and rendering issues.
+ Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089,
CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093,
CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098,
CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104,
CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117,
CVE-2017-7120, CVE-2017-7142.

– Enable gold linker on s390/s390x on SLE15/Tumbleweed.

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Workstation Extension 12-SP3:

zypper in -t patch SUSE-SLE-WE-12-SP3-2018-150=1

– SUSE Linux Enterprise Workstation Extension 12-SP2:

zypper in -t patch SUSE-SLE-WE-12-SP2-2018-150=1

– SUSE Linux Enterprise Software Development Kit 12-SP3:

zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-150=1

– SUSE Linux Enterprise Software Development Kit 12-SP2:

zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-150=1

– SUSE Linux Enterprise Server for Raspberry Pi 12-SP2:

zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-150=1

– SUSE Linux Enterprise Server 12-SP3:

zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-150=1

– SUSE Linux Enterprise Server 12-SP2:

zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-150=1

– SUSE Linux Enterprise Desktop 12-SP3:

zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-150=1

– SUSE Linux Enterprise Desktop 12-SP2:

zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-150=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Workstation Extension 12-SP3 (noarch):

libwebkit2gtk3-lang-2.18.5-2.18.1

– SUSE Linux Enterprise Workstation Extension 12-SP2 (noarch):

libwebkit2gtk3-lang-2.18.5-2.18.1

– SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):

webkit2gtk3-debugsource-2.18.5-2.18.1
webkit2gtk3-devel-2.18.5-2.18.1

– SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64):

webkit2gtk3-debugsource-2.18.5-2.18.1
webkit2gtk3-devel-2.18.5-2.18.1

– SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64):

libjavascriptcoregtk-4_0-18-2.18.5-2.18.1
libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1
libwebkit2gtk-4_0-37-2.18.5-2.18.1
libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1
typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1
typelib-1_0-WebKit2-4_0-2.18.5-2.18.1
webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1
webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1
webkit2gtk3-debugsource-2.18.5-2.18.1

– SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):

– SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64):

– SUSE Linux Enterprise Desktop 12-SP3 (noarch):

libwebkit2gtk3-lang-2.18.5-2.18.1

– SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

– SUSE Linux Enterprise Desktop 12-SP2 (x86_64):

– SUSE Linux Enterprise Desktop 12-SP2 (noarch):

libwebkit2gtk3-lang-2.18.5-2.18.1

References:

https://www.suse.com/security/cve/CVE-2016-4692.html
https://www.suse.com/security/cve/CVE-2016-4743.html
https://www.suse.com/security/cve/CVE-2016-7586.html
https://www.suse.com/security/cve/CVE-2016-7587.html
https://www.suse.com/security/cve/CVE-2016-7589.html
https://www.suse.com/security/cve/CVE-2016-7592.html
https://www.suse.com/security/cve/CVE-2016-7598.html
https://www.suse.com/security/cve/CVE-2016-7599.html
https://www.suse.com/security/cve/CVE-2016-7610.html
https://www.suse.com/security/cve/CVE-2016-7623.html
https://www.suse.com/security/cve/CVE-2016-7632.html
https://www.suse.com/security/cve/CVE-2016-7635.html
https://www.suse.com/security/cve/CVE-2016-7639.html
https://www.suse.com/security/cve/CVE-2016-7641.html
https://www.suse.com/security/cve/CVE-2016-7645.html
https://www.suse.com/security/cve/CVE-2016-7652.html
https://www.suse.com/security/cve/CVE-2016-7654.html
https://www.suse.com/security/cve/CVE-2016-7656.html
https://www.suse.com/security/cve/CVE-2017-13788.html
https://www.suse.com/security/cve/CVE-2017-13798.html
https://www.suse.com/security/cve/CVE-2017-13803.html
https://www.suse.com/security/cve/CVE-2017-13856.html
https://www.suse.com/security/cve/CVE-2017-13866.html
https://www.suse.com/security/cve/CVE-2017-13870.html
https://www.suse.com/security/cve/CVE-2017-2350.html
https://www.suse.com/security/cve/CVE-2017-2354.html
https://www.suse.com/security/cve/CVE-2017-2355.html
https://www.suse.com/security/cve/CVE-2017-2356.html
https://www.suse.com/security/cve/CVE-2017-2362.html
https://www.suse.com/security/cve/CVE-2017-2363.html
https://www.suse.com/security/cve/CVE-2017-2364.html
https://www.suse.com/security/cve/CVE-2017-2365.html
https://www.suse.com/security/cve/CVE-2017-2366.html
https://www.suse.com/security/cve/CVE-2017-2369.html
https://www.suse.com/security/cve/CVE-2017-2371.html
https://www.suse.com/security/cve/CVE-2017-2373.html
https://www.suse.com/security/cve/CVE-2017-2496.html
https://www.suse.com/security/cve/CVE-2017-2510.html
https://www.suse.com/security/cve/CVE-2017-2539.html
https://www.suse.com/security/cve/CVE-2017-5715.html
https://www.suse.com/security/cve/CVE-2017-5753.html
https://www.suse.com/security/cve/CVE-2017-5754.html
https://www.suse.com/security/cve/CVE-2017-7006.html
https://www.suse.com/security/cve/CVE-2017-7011.html
https://www.suse.com/security/cve/CVE-2017-7012.html
https://www.suse.com/security/cve/CVE-2017-7018.html
https://www.suse.com/security/cve/CVE-2017-7019.html
https://www.suse.com/security/cve/CVE-2017-7020.html
https://www.suse.com/security/cve/CVE-2017-7030.html
https://www.suse.com/security/cve/CVE-2017-7034.html
https://www.suse.com/security/cve/CVE-2017-7037.html
https://www.suse.com/security/cve/CVE-2017-7038.html
https://www.suse.com/security/cve/CVE-2017-7039.html
https://www.suse.com/security/cve/CVE-2017-7040.html
https://www.suse.com/security/cve/CVE-2017-7041.html
https://www.suse.com/security/cve/CVE-2017-7042.html
https://www.suse.com/security/cve/CVE-2017-7043.html
https://www.suse.com/security/cve/CVE-2017-7046.html
https://www.suse.com/security/cve/CVE-2017-7048.html
https://www.suse.com/security/cve/CVE-2017-7049.html
https://www.suse.com/security/cve/CVE-2017-7052.html
https://www.suse.com/security/cve/CVE-2017-7055.html
https://www.suse.com/security/cve/CVE-2017-7056.html
https://www.suse.com/security/cve/CVE-2017-7059.html
https://www.suse.com/security/cve/CVE-2017-7061.html
https://www.suse.com/security/cve/CVE-2017-7064.html
https://www.suse.com/security/cve/CVE-2017-7081.html
https://www.suse.com/security/cve/CVE-2017-7087.html
https://www.suse.com/security/cve/CVE-2017-7089.html
https://www.suse.com/security/cve/CVE-2017-7090.html
https://www.suse.com/security/cve/CVE-2017-7091.html
https://www.suse.com/security/cve/CVE-2017-7092.html
https://www.suse.com/security/cve/CVE-2017-7093.html
https://www.suse.com/security/cve/CVE-2017-7094.html
https://www.suse.com/security/cve/CVE-2017-7095.html
https://www.suse.com/security/cve/CVE-2017-7096.html
https://www.suse.com/security/cve/CVE-2017-7098.html
https://www.suse.com/security/cve/CVE-2017-7099.html
https://www.suse.com/security/cve/CVE-2017-7100.html
https://www.suse.com/security/cve/CVE-2017-7102.html
https://www.suse.com/security/cve/CVE-2017-7104.html
https://www.suse.com/security/cve/CVE-2017-7107.html
https://www.suse.com/security/cve/CVE-2017-7109.html
https://www.suse.com/security/cve/CVE-2017-7111.html
https://www.suse.com/security/cve/CVE-2017-7117.html
https://www.suse.com/security/cve/CVE-2017-7120.html
https://www.suse.com/security/cve/CVE-2017-7142.html
https://www.suse.com/security/cve/CVE-2017-7156.html
https://www.suse.com/security/cve/CVE-2017-7157.html
https://bugzilla.suse.com/1020950
https://bugzilla.suse.com/1024749
https://bugzilla.suse.com/1050469
https://bugzilla.suse.com/1066892
https://bugzilla.suse.com/1069925
https://bugzilla.suse.com/1073654
https://bugzilla.suse.com/1075419

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

Sigurnosni nedostaci programskog paketa webkit2gtk3

Archives

More in Preporuke

Sigurnosni nedostatak programskog paketa newsbeuter