Bug 26550 - webkit2 security issue fixed upstream (WSA-2020-0005, CVE-2020-3899)
Summary: webkit2 security issue fixed upstream (WSA-2020-0005, CVE-2020-3899)
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2020-04-27 23:14 CEST by David Walser
Modified: 2020-05-05 14:22 CEST (History)
4 users (show)

See Also:
Source RPM: webkit2-2.28.1-1.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2020-04-27 23:14:20 CEST
Upstream has issued an advisory today (April 27):
https://webkitgtk.org/security/WSA-2020-0005.html

The issue is fixed upstream in 2.28.2:
https://webkitgtk.org/2020/04/24/webkitgtk2.28.2-released.html
Comment 1 David Walser 2020-04-27 23:18:32 CEST
Updates building for Mageia 7 and Cauldron.

Suggested advisory:
========================

Updated webkit2 packages fix security vulnerabilities:

A memory consumption issue was addressed with improved memory handling. A
remote attacker may be able to cause arbitrary code execution (CVE-2020-3899).

The webkit2 package has been updated to version 2.28.2, fixing this issue and
other bugs.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3899
https://webkitgtk.org/2020/04/24/webkitgtk2.28.2-released.html
https://webkitgtk.org/security/WSA-2020-0005.html
========================

Updated packages in core/updates_testing:
========================
webkit2-2.28.2-1.mga7
webkit2-jsc-2.28.2-1.mga7
libwebkit2gtk4.0_37-2.28.2-1.mga7
libjavascriptcoregtk4.0_18-2.28.2-1.mga7
libwebkit2-devel-2.28.2-1.mga7
libjavascriptcore-gir4.0-2.28.2-1.mga7
libwebkit2gtk-gir4.0-2.28.2-1.mga7

from webkit2-2.28.2-1.mga7.src.rpm
Comment 2 David Walser 2020-04-28 00:06:42 CEST
Should be uploading soon.  See Comment 1.

Assignee: bugsquad => qa-bugs

Comment 3 Herman Viaene 2020-04-28 14:46:45 CEST
MGA7-64 Plasma on Lenovo B50
No installation issues
Ref bug 26487 for testing.
$ zenity --calendar
30/04/20
seems OK, but I see a difference with the previous test:
Now if I click once on a date, I get no feedback, double clicking displays the feedback and closes the window (same as selecting and clicking OK).
In previous tests, I could click on a date, get the feedback, click on another date, get feedback and only close the window when clicking OK.
AFAIK, there hasn't been an update on zenity lately, so I wonder.
Someone else might hae other testing ideas, I will however not object the OK.

CC: (none) => herman.viaene

Comment 4 David Walser 2020-04-30 19:15:16 CEST
Ubuntu has issued an advisory for this on April 29:
https://usn.ubuntu.com/4347-1/
Comment 5 Thomas Andrews 2020-05-05 01:24:38 CEST
(In reply to Herman Viaene from comment #3)
> MGA7-64 Plasma on Lenovo B50
> No installation issues
> Ref bug 26487 for testing.
> $ zenity --calendar
> 30/04/20
> seems OK, but I see a difference with the previous test:
> Now if I click once on a date, I get no feedback, double clicking displays
> the feedback and closes the window (same as selecting and clicking OK).
> In previous tests, I could click on a date, get the feedback, click on
> another date, get feedback and only close the window when clicking OK.
> AFAIK, there hasn't been an update on zenity lately, so I wonder.
> Someone else might hae other testing ideas, I will however not object the OK.

Herman, I see the same thing with that command both before and after the webkit2 update, so it would appear that observation is not related to those packages.

I'm going to give it an OK, and validate it. Advisory in Comment 1.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update
Whiteboard: (none) => MGA7-64-OK

Thomas Backlund 2020-05-05 11:48:52 CEST

CC: (none) => tmb
Keywords: (none) => advisory

Comment 6 Mageia Robot 2020-05-05 14:22:30 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0188.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.