{"affected":[{"ecosystem_specific":{"binaries":[{"libjavascriptcoregtk-4_0-18":"2.18.0-2.9.1","libwebkit2gtk-4_0-37":"2.18.0-2.9.1","libwebkit2gtk3-lang":"2.18.0-2.9.1","typelib-1_0-JavaScriptCore-4_0":"2.18.0-2.9.1","typelib-1_0-WebKit2-4_0":"2.18.0-2.9.1","webkit2gtk-4_0-injected-bundles":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libjavascriptcoregtk-4_0-18":"2.18.0-2.9.1","libwebkit2gtk-4_0-37":"2.18.0-2.9.1","libwebkit2gtk3-lang":"2.18.0-2.9.1","typelib-1_0-JavaScriptCore-4_0":"2.18.0-2.9.1","typelib-1_0-WebKit2-4_0":"2.18.0-2.9.1","webkit2gtk-4_0-injected-bundles":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libjavascriptcoregtk-4_0-18":"2.18.0-2.9.1","libwebkit2gtk-4_0-37":"2.18.0-2.9.1","typelib-1_0-JavaScriptCore-4_0":"2.18.0-2.9.1","typelib-1_0-WebKit2-4_0":"2.18.0-2.9.1","webkit2gtk-4_0-injected-bundles":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"webkit2gtk3-devel":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"webkit2gtk3-devel":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libjavascriptcoregtk-4_0-18":"2.18.0-2.9.1","libwebkit2gtk-4_0-37":"2.18.0-2.9.1","typelib-1_0-JavaScriptCore-4_0":"2.18.0-2.9.1","typelib-1_0-WebKit2-4_0":"2.18.0-2.9.1","webkit2gtk-4_0-injected-bundles":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libjavascriptcoregtk-4_0-18":"2.18.0-2.9.1","libwebkit2gtk-4_0-37":"2.18.0-2.9.1","typelib-1_0-JavaScriptCore-4_0":"2.18.0-2.9.1","typelib-1_0-WebKit2-4_0":"2.18.0-2.9.1","webkit2gtk-4_0-injected-bundles":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libjavascriptcoregtk-4_0-18":"2.18.0-2.9.1","libwebkit2gtk-4_0-37":"2.18.0-2.9.1","typelib-1_0-JavaScriptCore-4_0":"2.18.0-2.9.1","typelib-1_0-WebKit2-4_0":"2.18.0-2.9.1","webkit2gtk-4_0-injected-bundles":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libjavascriptcoregtk-4_0-18":"2.18.0-2.9.1","libwebkit2gtk-4_0-37":"2.18.0-2.9.1","typelib-1_0-JavaScriptCore-4_0":"2.18.0-2.9.1","typelib-1_0-WebKit2-4_0":"2.18.0-2.9.1","webkit2gtk-4_0-injected-bundles":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libwebkit2gtk3-lang":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libwebkit2gtk3-lang":"2.18.0-2.9.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","name":"webkit2gtk3","purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for webkit2gtk3 to version 2.18.0 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-7039: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7018: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7030: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7037: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7034: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7055: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7056: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7064: An issue was fixed that allowed remote attackers to bypass\n  intended memory-read restrictions via a crafted app (bsc#1050469).\n- CVE-2017-7061: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7048: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7046: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1050469).\n- CVE-2017-2538: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1045460)\n- CVE-2017-2496: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site.\n- CVE-2017-2539: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site.\n- CVE-2017-2510: An issue was fixed that allowed remote attackers to conduct\n  Universal XSS (UXSS) attacks via a crafted web site that improperly\n  interacts with pageshow events.\n- CVE-2017-2365: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site (bsc#1024749)\n- CVE-2017-2366: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2373: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2363: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site (bsc#1024749)\n- CVE-2017-2362: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2350: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site (bsc#1024749)\n- CVE-2017-2350: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web site\n  (bsc#1024749)\n- CVE-2017-2354: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749).\n- CVE-2017-2355: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (uninitialized memory\n  access and application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2356: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2371: An issue was fixed that allowed remote attackers to launch\n  popups via a crafted web site (bsc#1024749)\n- CVE-2017-2364: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site (bsc#1024749)\n- CVE-2017-2369: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2016-7656: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7635: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7654: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7639: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7645: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7652: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7641: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7632: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7599: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site that used HTTP redirects (bsc#1020950)\n- CVE-2016-7592: An issue was fixed that allowed remote attackers to obtain\n  sensitive information via crafted JavaScript prompts on a web site (bsc#1020950)\n- CVE-2016-7589: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7623: An issue was fixed that allowed remote attackers to obtain\n  sensitive information via a blob URL on a web site (bsc#1020950)\n- CVE-2016-7586: An issue was fixed that allowed remote attackers to obtain\n  sensitive information via a crafted web site (bsc#1020950)\n\nFor other non-security fixes please check the changelog.\n","id":"SUSE-SU-2017:2933-1","modified":"2017-11-06T08:39:55Z","published":"2017-11-06T08:39:55Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172933-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1020950"},{"type":"REPORT","url":"https://bugzilla.suse.com/1024749"},{"type":"REPORT","url":"https://bugzilla.suse.com/1045460"},{"type":"REPORT","url":"https://bugzilla.suse.com/1050469"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7586"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7589"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7592"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7599"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7623"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7632"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7635"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7639"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7641"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7645"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7652"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7654"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7656"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2350"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2354"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2355"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2356"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2362"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2363"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2364"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2365"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2366"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2369"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2371"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2373"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2496"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2510"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2538"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2539"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7018"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7030"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7034"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7037"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7039"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7046"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7048"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7055"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7056"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7061"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7064"}],"related":["CVE-2016-7586","CVE-2016-7589","CVE-2016-7592","CVE-2016-7599","CVE-2016-7623","CVE-2016-7632","CVE-2016-7635","CVE-2016-7639","CVE-2016-7641","CVE-2016-7645","CVE-2016-7652","CVE-2016-7654","CVE-2016-7656","CVE-2017-2350","CVE-2017-2354","CVE-2017-2355","CVE-2017-2356","CVE-2017-2362","CVE-2017-2363","CVE-2017-2364","CVE-2017-2365","CVE-2017-2366","CVE-2017-2369","CVE-2017-2371","CVE-2017-2373","CVE-2017-2496","CVE-2017-2510","CVE-2017-2538","CVE-2017-2539","CVE-2017-7018","CVE-2017-7030","CVE-2017-7034","CVE-2017-7037","CVE-2017-7039","CVE-2017-7046","CVE-2017-7048","CVE-2017-7055","CVE-2017-7056","CVE-2017-7061","CVE-2017-7064"],"summary":"Security update for webkit2gtk3","upstream":["CVE-2016-7586","CVE-2016-7589","CVE-2016-7592","CVE-2016-7599","CVE-2016-7623","CVE-2016-7632","CVE-2016-7635","CVE-2016-7639","CVE-2016-7641","CVE-2016-7645","CVE-2016-7652","CVE-2016-7654","CVE-2016-7656","CVE-2017-2350","CVE-2017-2354","CVE-2017-2355","CVE-2017-2356","CVE-2017-2362","CVE-2017-2363","CVE-2017-2364","CVE-2017-2365","CVE-2017-2366","CVE-2017-2369","CVE-2017-2371","CVE-2017-2373","CVE-2017-2496","CVE-2017-2510","CVE-2017-2538","CVE-2017-2539","CVE-2017-7018","CVE-2017-7030","CVE-2017-7034","CVE-2017-7037","CVE-2017-7039","CVE-2017-7046","CVE-2017-7048","CVE-2017-7055","CVE-2017-7056","CVE-2017-7061","CVE-2017-7064"]}