Resource management error in WPE WebKit and WebKitGTK+ - CVE-2019-8768

Vulnerability identifier: #VU23180

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-8768

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to “Clear History and Website Data” does not clear the history. A remote attacker can gain unauthorized access to sensitive information on the system.

WPE WebKit
WebKitGTK+
Gentoo Linux
SUSE CaaS Platform
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
Opensuse
SUSE Linux Enterprise High Performance Computing
webkit2gtk (Alpine package)
net-libs/webkit-gtk
libwebkit2gtk-4_0-37
libjavascriptcoregtk-4_0-18
webkit2gtk3-devel
libwebkit2gtk3-lang
webkit2gtk3-debugsource
webkit2gtk-4_0-injected-bundles-debuginfo
typelib-1_0-WebKit2WebExtension-4_0
libjavascriptcoregtk-4_0-18-debuginfo
libwebkit2gtk-4_0-37-debuginfo
typelib-1_0-JavaScriptCore-4_0
typelib-1_0-WebKit2-4_0
webkit2gtk-4_0-injected-bundles

Install updates from vendor's website.

WPE WebKit - update to 2.24.0
WebKitGTK+ - update to 2.24.0
webkit2gtk (Alpine package) - update to 2.26.2-r0
net-libs/webkit-gtk - update to 2.26.4
libwebkit2gtk-4_0-37 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
libjavascriptcoregtk-4_0-18 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
webkit2gtk3-devel - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
libwebkit2gtk3-lang - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
webkit2gtk3-debugsource - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
webkit2gtk-4_0-injected-bundles-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
typelib-1_0-WebKit2WebExtension-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
libjavascriptcoregtk-4_0-18-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
libwebkit2gtk-4_0-37-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
typelib-1_0-JavaScriptCore-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
typelib-1_0-WebKit2-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1
webkit2gtk-4_0-injected-bundles - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1

• https://webkitgtk.org/security/WSA-2019-0005.html

• Multiple vulnerabilities in WebKitGTK and WPE WebKit
• OpenSUSE Linux update for webkit2gtk3
• OpenSUSE Linux update for webkit2gtk3
• Resource management error in webkit2gtk (Alpine package)
• SUSE update for webkit2gtk3
• SUSE update for webkit2gtk3
• Gentoo update for WebkitGTK+