{"action":"opened","issue":{"url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/issues/1395","repository_url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs","labels_url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/issues/1395/labels{/name}","comments_url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/issues/1395/comments","events_url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/issues/1395/events","html_url":"https://github.com/AOSC-Dev/aosc-os-abbs/issues/1395","id":365096580,"node_id":"MDU6SXNzdWUzNjUwOTY1ODA=","number":1395,"title":"webkit2gtk: security update to ^2.22.0","user":{"login":"l2dy","id":14329097,"node_id":"MDQ6VXNlcjE0MzI5MDk3","avatar_url":"https://avatars3.githubusercontent.com/u/14329097?v=4","gravatar_id":"","url":"https://api.github.com/users/l2dy","html_url":"https://github.com/l2dy","followers_url":"https://api.github.com/users/l2dy/followers","following_url":"https://api.github.com/users/l2dy/following{/other_user}","gists_url":"https://api.github.com/users/l2dy/gists{/gist_id}","starred_url":"https://api.github.com/users/l2dy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/l2dy/subscriptions","organizations_url":"https://api.github.com/users/l2dy/orgs","repos_url":"https://api.github.com/users/l2dy/repos","events_url":"https://api.github.com/users/l2dy/events{/privacy}","received_events_url":"https://api.github.com/users/l2dy/received_events","type":"User","site_admin":false},"labels":[{"id":365941796,"node_id":"MDU6TGFiZWwzNjU5NDE3OTY=","url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/labels/security","name":"security","color":"b60205","default":false},{"id":256569692,"node_id":"MDU6TGFiZWwyNTY1Njk2OTI=","url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/labels/upgrade","name":"upgrade","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-29T04:42:46Z","updated_at":"2018-09-29T04:42:46Z","closed_at":null,"author_association":"MEMBER","body":"CVE IDs (if any)\r\n---------------------\r\n\r\nCVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4311, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361\r\n\r\nOther security advisory IDs (if any)\r\n------------------------------------------------\r\n\r\n[WSA-2018-0007](https://webkitgtk.org/security/WSA-2018-0007.html)\r\n\r\nPatches (if any)\r\n----------------------\r\n\r\nN/A\r\n\r\nPoC(s) (if any)\r\n-------------------\r\n\r\nN/A\r\n\r\nAdditional descriptions (if applicable)\r\n----------------------------------------------------\r\n\r\nCVE-2018-4191\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Google OSS-Fuzz.\r\n  Unexpected interaction causes an ASSERT failure. A memory corruption\r\n  issue was addressed with improved validation.\r\n\r\nCVE-2018-4197\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. A use after free issue was addressed with improved\r\n  memory management.\r\n\r\nCVE-2018-4299\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Samuel Groβ (saelo) working with Trend Micro's Zero Day\r\n  Initiative.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. Multiple memory corruption issues were addressed\r\n  with improved memory handling.\r\n\r\nCVE-2018-4306\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. A use after free issue was addressed with improved\r\n  memory management.\r\n\r\nCVE-2018-4309\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to an anonymous researcher working with Trend Micro's Zero\r\n  Day Initiative.\r\n  A malicious website may be able to execute scripts in the context of\r\n  another website. A cross-site scripting issue existed in WebKit.\r\n  This issue was addressed with improved URL validation.\r\n\r\nCVE-2018-4311\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Erling Alf Ellingsen (@steike).\r\n  Cross-origin SecurityErrors includes the accessed frame’s origin.\r\n  The issue was addressed by removing origin information.\r\n\r\nCVE-2018-4312\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. A use after free issue was addressed with improved\r\n  memory management.\r\n\r\nCVE-2018-4314\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. A use after free issue was addressed with improved\r\n  memory management.\r\n\r\nCVE-2018-4315\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. A use after free issue was addressed with improved\r\n  memory management.\r\n\r\nCVE-2018-4316\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan\r\n  Team.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. A memory corruption issue was addressed with\r\n  improved state management.\r\n\r\nCVE-2018-4317\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. A use after free issue was addressed with improved\r\n  memory management.\r\n\r\nCVE-2018-4318\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. A use after free issue was addressed with improved\r\n  memory management.\r\n\r\nCVE-2018-4319\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to John Pettitt of Google.\r\n  A malicious website may cause unexepected cross-origin behavior. A\r\n  cross-origin issue existed with iframe elements. This was addressed\r\n  with improved tracking of security origins.\r\n\r\nCVE-2018-4323\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. Multiple memory corruption issues were addressed\r\n  with improved memory handling.\r\n\r\nCVE-2018-4328\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Ivan Fratric of Google Project Zero.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. Multiple memory corruption issues were addressed\r\n  with improved memory handling.\r\n\r\nCVE-2018-4358\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with\r\n  Trend Micro's Zero Day Initiative.\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. Multiple memory corruption issues were addressed\r\n  with improved memory handling.\r\n\r\nCVE-2018-4359\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Samuel Groß (@5aelo).\r\n  Processing maliciously crafted web content may lead to arbitrary\r\n  code execution. Multiple memory corruption issues were addressed\r\n  with improved memory handling.\r\n\r\nCVE-2018-4361\r\n  Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.\r\n  Credit to Google OSS-Fuzz.\r\n  Unexpected interaction causes an ASSERT failure. A memory corruption\r\n  issue was addressed with improved memory handling.\r\n\r\nArchitectural progress\r\n--------------------------------\r\n\r\n*Please remove any architecture to which the security vulnerabilities do not apply.*\r\n\r\n- [ ] AMD64 (`amd64`)\r\n    - [ ] 32-bit Optional Environment (`optenv32`)\r\n- [ ] AArch64 (`arm64`)\r\n- [ ] ARMv7 (`armel`)\r\n- [ ] PowerPC 64-bit BE (`ppc64`)\r\n- [ ] PowerPC 32-bit BE (`powerpc`)\r\n- [ ] RISC-V 64-bit (`riscv64`)\r\n"}}
{"actor":{"display_login":"l2dy"}}