=====================================================================

                             CERT-Renater

                   Note d'Information No. 2022/VULN035
_____________________________________________________________________

DATE                : 27/01/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running WebKitGTK, WPE WebKit versions
                               prior to 2.34.4, 2.32.4.

=====================================================================
https://webkitgtk.org/security/WSA-2022-0001.html
https://wpewebkit.org/security/WSA-2022-0001.html
_____________________________________________________________________

------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory                 WSA-2022-0001
------------------------------------------------------------------------

Date reported           : January 21, 2022
Advisory ID             : WSA-2022-0001
WebKitGTK Advisory URL  : https://webkitgtk.org/security/WSA-2022-0001.html
WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2022-0001.html
CVE identifiers         : CVE-2021-30934, CVE-2021-30936,
                           CVE-2021-30951, CVE-2021-30952,
                           CVE-2021-30953, CVE-2021-30954,
                           CVE-2021-30984, CVE-2022-XXXXX,
                           CVE-2021-45481, CVE-2021-45482,
                           CVE-2021-45483.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2021-30934
     Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
     Credit to Dani Biro.
     Impact: Processing maliciously crafted web content may lead to
     arbitrary code execution. Description: A buffer overflow issue was
     addressed with improved memory handling.

CVE-2021-30936
     Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
     Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher
     lab.
     Impact: Processing maliciously crafted web content may lead to
     arbitrary code execution. Description: A use after free issue was
     addressed with improved memory management.

CVE-2021-30951
     Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
     Credit to Pangu.
     Impact: Processing maliciously crafted web content may lead to
     arbitrary code execution. Description: A use after free issue was
     addressed with improved memory management.

CVE-2021-30952
     Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
     Credit to WeBin.
     Impact: Processing maliciously crafted web content may lead to
     arbitrary code execution. Description: An integer overflow was
     addressed with improved input validation.

CVE-2021-30953
     Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
     Credit to VRIJ.
     Impact: Processing maliciously crafted web content may lead to
     arbitrary code execution. Description: An out-of-bounds read was
     addressed with improved bounds checking.

CVE-2021-30954
     Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
     Credit to Kunlun Lab.
     Impact: Processing maliciously crafted web content may lead to
     arbitrary code execution. Description: A type confusion issue was
     addressed with improved memory handling.

CVE-2021-30984
     Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
     Credit to Kunlun Lab.
     Impact: Processing maliciously crafted web content may lead to
     arbitrary code execution. Description: A race condition was
     addressed with improved state handling.

CVE-2022-XXXXX
     Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
     Credit to Martin Bajanik from fingerprintjs.com.
     Impact: A malicious website may exfiltrate data cross-origin.
     Description: A cross-origin issue existed with the IndexedDB. This
     was addressed with improved checking of security origins.
     Notes: There is a public PoC demonstrating this issue at
     https://safarileaks.com so this issue may have been actively
     exploited. We still don't know the CVE number that will be assigned
     to this issue. We will update this advisory once we know it.

CVE-2021-45481
     Versions affected: WebKitGTK and WPE WebKit before 2.34.0.
     Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.
     Processing maliciously crafted web content may cause an application
     crash due to an incorrect memory allocation in
     WebCore::ImageBufferCairoImageSurfaceBackend::create

CVE-2021-45482
     Versions affected: WebKitGTK and WPE WebKit before 2.32.4.
     Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.
     Processing maliciously crafted web content may cause a memory
     corruption issue (use-after-free) in WebCore::ContainerNode::firstChild

CVE-2021-45483
     Versions affected: WebKitGTK and WPE WebKit before 2.34.0.
     Credit to Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab.
     Processing maliciously crafted web content may cause a memory
     corruption issue (heap-use-after-free) in WebCore::Frame::page


We recommend updating to the latest stable versions of WebKitGTK and WPE
WebKit. It is the best way to ensure that you are running safe versions
of WebKit. Please check our websites for information about the latest
stable releases.

Further information about WebKitGTK and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.

The WebKitGTK and WPE WebKit team,
January 21, 2022

=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================