Security update for webkit2gtk3

SUSE Security Update: Security update for webkit2gtk3
Announcement ID: SUSE-SU-2018:0219-1
Rating: important
References: #1020950 #1024749 #1050469 #1066892 #1069925 #1073654 #1075419
Affected Products:
  • SUSE Linux Enterprise Workstation Extension 12-SP3
  • SUSE Linux Enterprise Workstation Extension 12-SP2
  • SUSE Linux Enterprise Software Development Kit 12-SP3
  • SUSE Linux Enterprise Software Development Kit 12-SP2
  • SUSE Linux Enterprise Server for Raspberry Pi 12-SP2
  • SUSE Linux Enterprise Server 12-SP3
  • SUSE Linux Enterprise Server 12-SP2
  • SUSE Linux Enterprise Desktop 12-SP3
  • SUSE Linux Enterprise Desktop 12-SP2

  • An update that fixes 89 vulnerabilities is now available.

    Description:



    This update for webkit2gtk3 fixes the following issues:

    Update to version 2.18.5:

    + Disable SharedArrayBuffers from Web API.
    + Reduce the precision of "high" resolution time to 1ms.
    + bsc#1075419 - Security fixes: includes improvements to mitigate the
    effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715).

    Update to version 2.18.4:

    + Make WebDriver implementation more spec compliant.
    + Fix a bug when trying to remove cookies before a web process is
    spawned.
    + WebKitWebDriver process no longer links to libjavascriptcoregtk.
    + Fix several memory leaks in GStreamer media backend.
    + bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870,
    CVE-2017-7156, CVE-2017-13856.

    Update to version 2.18.3:

    + Improve calculation of font metrics to prevent scrollbars from being
    shown unnecessarily in some cases.
    + Fix handling of null capabilities in WebDriver implementation.
    + Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803.

    Update to version 2.18.2:

    + Fix rendering of arabic text.
    + Fix a crash in the web process when decoding GIF images.
    + Fix rendering of wind in Windy.com.
    + Fix several crashes and rendering issues.

    Update to version 2.18.1:

    + Improve performance of GIF animations.
    + Fix garbled display in GMail.
    + Fix rendering of several material design icons when using the web font.
    + Fix flickering when resizing the window in Wayland.
    + Prevent default kerberos authentication credentials from being used in
    ephemeral sessions.
    + Fix a crash when webkit_web_resource_get_data() is cancelled.
    + Correctly handle touchmove and touchend events in WebKitWebView.
    + Fix the build with enchant 2.1.1.
    + Fix the build in HPPA and Alpha.
    + Fix several crashes and rendering issues.
    + Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089,
    CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093,
    CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098,
    CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104,
    CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117,
    CVE-2017-7120, CVE-2017-7142.

    - Enable gold linker on s390/s390x on SLE15/Tumbleweed.

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Workstation Extension 12-SP3:
      zypper in -t patch SUSE-SLE-WE-12-SP3-2018-150=1
    • SUSE Linux Enterprise Workstation Extension 12-SP2:
      zypper in -t patch SUSE-SLE-WE-12-SP2-2018-150=1
    • SUSE Linux Enterprise Software Development Kit 12-SP3:
      zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-150=1
    • SUSE Linux Enterprise Software Development Kit 12-SP2:
      zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-150=1
    • SUSE Linux Enterprise Server for Raspberry Pi 12-SP2:
      zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-150=1
    • SUSE Linux Enterprise Server 12-SP3:
      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-150=1
    • SUSE Linux Enterprise Server 12-SP2:
      zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-150=1
    • SUSE Linux Enterprise Desktop 12-SP3:
      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-150=1
    • SUSE Linux Enterprise Desktop 12-SP2:
      zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-150=1

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Workstation Extension 12-SP3 (noarch):
      • libwebkit2gtk3-lang-2.18.5-2.18.1
    • SUSE Linux Enterprise Workstation Extension 12-SP2 (noarch):
      • libwebkit2gtk3-lang-2.18.5-2.18.1
    • SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):
      • webkit2gtk3-debugsource-2.18.5-2.18.1
      • webkit2gtk3-devel-2.18.5-2.18.1
    • SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64):
      • webkit2gtk3-debugsource-2.18.5-2.18.1
      • webkit2gtk3-devel-2.18.5-2.18.1
    • SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64):
      • libjavascriptcoregtk-4_0-18-2.18.5-2.18.1
      • libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1
      • typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1
      • typelib-1_0-WebKit2-4_0-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1
      • webkit2gtk3-debugsource-2.18.5-2.18.1
    • SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):
      • libjavascriptcoregtk-4_0-18-2.18.5-2.18.1
      • libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1
      • typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1
      • typelib-1_0-WebKit2-4_0-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1
      • webkit2gtk3-debugsource-2.18.5-2.18.1
    • SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64):
      • libjavascriptcoregtk-4_0-18-2.18.5-2.18.1
      • libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1
      • typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1
      • typelib-1_0-WebKit2-4_0-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1
      • webkit2gtk3-debugsource-2.18.5-2.18.1
    • SUSE Linux Enterprise Desktop 12-SP3 (noarch):
      • libwebkit2gtk3-lang-2.18.5-2.18.1
    • SUSE Linux Enterprise Desktop 12-SP3 (x86_64):
      • libjavascriptcoregtk-4_0-18-2.18.5-2.18.1
      • libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1
      • typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1
      • typelib-1_0-WebKit2-4_0-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1
      • webkit2gtk3-debugsource-2.18.5-2.18.1
    • SUSE Linux Enterprise Desktop 12-SP2 (x86_64):
      • libjavascriptcoregtk-4_0-18-2.18.5-2.18.1
      • libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-2.18.5-2.18.1
      • libwebkit2gtk-4_0-37-debuginfo-2.18.5-2.18.1
      • typelib-1_0-JavaScriptCore-4_0-2.18.5-2.18.1
      • typelib-1_0-WebKit2-4_0-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-2.18.5-2.18.1
      • webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-2.18.1
      • webkit2gtk3-debugsource-2.18.5-2.18.1
    • SUSE Linux Enterprise Desktop 12-SP2 (noarch):
      • libwebkit2gtk3-lang-2.18.5-2.18.1

    References: