{"affected":[{"ecosystem_specific":{"binaries":[{"libjavascriptcoregtk-4_0-18":"2.20.5-3.8.1","libwebkit2gtk-4_0-37":"2.20.5-3.8.1","libwebkit2gtk3-lang":"2.20.5-3.8.1","webkit2gtk-4_0-injected-bundles":"2.20.5-3.8.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","name":"webkit2gtk3","purl":"purl:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.20.5-3.8.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"typelib-1_0-JavaScriptCore-4_0":"2.20.5-3.8.1","typelib-1_0-WebKit2-4_0":"2.20.5-3.8.1","typelib-1_0-WebKit2WebExtension-4_0":"2.20.5-3.8.1","webkit2gtk3-devel":"2.20.5-3.8.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","name":"webkit2gtk3","purl":"purl:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.20.5-3.8.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for webkit2gtk3 to version 2.20.5 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-12911: Fix off-by-one in xdg_mime_get_simple_globs (bsc#1101999).\n- CVE-2018-4261, CVE-2018-4262, CVE-2018-4263, CVE-2018-4264, CVE-2018-4265,\n  CVE-2018-4267, CVE-2018-4272, CVE-2018-4284: Processing maliciously crafted\n  web content may lead to arbitrary code execution. A memory corruption issue\n  was addressed with improved memory handling.\n- CVE-2018-4266: A malicious website may be able to cause a denial of service.\n  A race condition was addressed with additional validation.\n- CVE-2018-4270, CVE-2018-4271, CVE-2018-4273: Processing maliciously crafted\n  web content may lead to an unexpected application crash. A memory corruption\n  issue was addressed with improved input validation.\n- CVE-2018-4278: A malicious website may exfiltrate audio data cross-origin.\n  Sound fetched through audio elements may be exfiltrated cross-origin. This\n  issue was addressed with improved audio taint tracking.\n\nOther bugs fixed:\n\n- Fix rendering artifacts in some web sites due to a bug introduced in 2.20.4.\n- Fix a crash when leaving accelerated compositing mode.\n- Fix non-deterministic build failure due to missing JavaScriptCore/JSContextRef.h.\n","id":"SUSE-SU-2018:2752-1","modified":"2018-09-19T10:58:11Z","published":"2018-09-19T10:58:11Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182752-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1101999"},{"type":"REPORT","url":"https://bugzilla.suse.com/1104169"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-12911"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4261"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4262"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4263"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4264"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4265"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4266"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4267"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4270"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4271"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4272"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4273"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4278"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-4284"}],"related":["CVE-2018-12911","CVE-2018-4261","CVE-2018-4262","CVE-2018-4263","CVE-2018-4264","CVE-2018-4265","CVE-2018-4266","CVE-2018-4267","CVE-2018-4270","CVE-2018-4271","CVE-2018-4272","CVE-2018-4273","CVE-2018-4278","CVE-2018-4284"],"summary":"Security update for webkit2gtk3"}