Red Hat Security Advisory

RHSA-2011:0177

webkitgtk security update

Released 2011-01-25 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) webkitgtk-1.2.6-2.el6_0
Red Hat Enterprise Linux Desktop Optional (v. 6) webkitgtk-1.2.6-2.el6_0, webkitgtk-devel-1.2.6-2.el6_0, webkitgtk-doc-1.2.6-2.el6_0
Red Hat Enterprise Linux HPC Node Optional (v. 6) webkitgtk-1.2.6-2.el6_0, webkitgtk-devel-1.2.6-2.el6_0, webkitgtk-doc-1.2.6-2.el6_0
Red Hat Enterprise Linux Server (v. 6) webkitgtk-1.2.6-2.el6_0, webkitgtk-1.2.6-2.el6_0.ppc
Red Hat Enterprise Linux Server Optional (v. 6) webkitgtk-1.2.6-2.el6_0, webkitgtk-devel-1.2.6-2.el6_0, webkitgtk-devel-1.2.6-2.el6_0.ppc +1
Red Hat Enterprise Linux Workstation (v. 6) webkitgtk-1.2.6-2.el6_0
Red Hat Enterprise Linux Workstation Optional (v. 6) webkitgtk-1.2.6-2.el6_0, webkitgtk-devel-1.2.6-2.el6_0, webkitgtk-doc-1.2.6-2.el6_0

Fixes 30 records

TI-2010-01730 CVE-2010-1807 · GHSA-qhcv-5g2q-vm4c

WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and…

HIGH 75

WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cau…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.61319 Published 2010-09-10 Fixed CWE-20

TI-2010-03621 CVE-2010-3812 · GHSA-5p66-5j6r-4m29

Integer overflow in the Text::wholeText method in dom/Text.cpp in WebKit, as used in…

MEDIUM 50

Integer overflow in the Text::wholeText method in dom/Text.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and pos…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06924 Published 2010-11-20 Fixed CWE-189

TI-2010-01717 CVE-2010-1793 · GHSA-8c57-9rmr-c96c

Multiple use-after-free vulnerabilities in WebKit in Apple Safari before 5.0.1 on Mac OS…

MEDIUM 50

Multiple use-after-free vulnerabilities in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allow remote attackers to execute a…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06728 Published 2010-07-30 Fixed CWE-399

TI-2010-02978 CVE-2010-3116 · GHSA-r86w-r23c-j68w

Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3…

MEDIUM 49

Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, allow remote attackers to execute arbitrary co…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03694 Published 2010-08-24 Fixed CWE-416

TI-2010-01716 CVE-2010-1792 · GHSA-m648-9796-m2xj

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before…

MEDIUM 49

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06012 Published 2010-07-30 Fixed CWE-119

TI-2010-01714 CVE-2010-1790 · GHSA-xv9r-2fwv-jqq3

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before…

MEDIUM 49

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; does not properly handle just-in-time (JIT) compiled JavaScript stubs, which a…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06084 Published 2010-07-30 Fixed

TI-2010-01712 CVE-2010-1788 · GHSA-7cc6-8g5j-cxh5

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before…

MEDIUM 49

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05961 Published 2010-07-30 Fixed CWE-119

TI-2010-01711 CVE-2010-1787 · GHSA-pfg4-6prx-gw2j

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before…

MEDIUM 49

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05961 Published 2010-07-30 Fixed CWE-119

TI-2010-01710 CVE-2010-1786 · GHSA-pr69-qp8p-89mr

Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5…

MEDIUM 49

Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary c…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06084 Published 2010-07-30 Fixed CWE-399

TI-2010-01709 CVE-2010-1785 · GHSA-889q-fj7g-jv5v

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before…

MEDIUM 49

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; accesses uninitialized memory during processing of the (1) :first-letter and (…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06084 Published 2010-07-30 Fixed CWE-119

TI-2010-01708 CVE-2010-1784 · GHSA-463m-jv3p-fxxc

The counters functionality in the Cascading Style Sheets (CSS) implementation in WebKit…

MEDIUM 49

The counters functionality in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05961 Published 2010-07-30 Fixed CWE-119

TI-2010-01707 CVE-2010-1783 · GHSA-8v7f-cgc9-8qfx

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before…

MEDIUM 49

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; does not properly handle dynamic modification of a text node, which allows rem…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05961 Published 2010-07-30 Fixed CWE-119

TI-2010-01706 CVE-2010-1782 · GHSA-vxgg-gfpj-v87j

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before…

MEDIUM 49

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05961 Published 2010-07-30 Fixed CWE-119

TI-2010-01704 CVE-2010-1780 · GHSA-qchc-75qg-v264

Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5…

MEDIUM 49

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06084 Published 2010-07-30 Fixed CWE-399

TI-2010-02975 CVE-2010-3113 · GHSA-6rmh-frj6-3p9r

Google Chrome before 5.0.375.127, and webkitgtk before 1.2.5, does not properly handle…

MEDIUM 48

Google Chrome before 5.0.375.127, and webkitgtk before 1.2.5, does not properly handle SVG documents, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impa…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.029 Published 2010-08-24 Fixed CWE-119

TI-2010-03957 CVE-2010-4204 · GHSA-q8xw-2wr3-xhfh

WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other…

MEDIUM 46

WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object has been destroyed, which allows remote attackers to cause a denial of service or…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02256 Published 2010-11-05 Fixed

TI-2010-03951 CVE-2010-4197 · GHSA-63hm-wg3m-vxc6

Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44…

MEDIUM 46

Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impa…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02307 Published 2010-11-05 Fixed CWE-416

TI-2010-03114 CVE-2010-3257 · GHSA-rp6m-p8jm-p6fq

Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x…

MEDIUM 46

Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03306 Published 2010-09-07 Fixed CWE-416

TI-2010-02981 CVE-2010-3119 · GHSA-3hjv-5h38-3p2g

Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the…

MEDIUM 46

Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0142 Published 2010-08-24 Fixed CWE-119

TI-2010-02976 CVE-2010-3114 · GHSA-6mv5-m43j-9667

The text-editing implementation in Google Chrome before 5.0.375.127, and webkitgtk before…

MEDIUM 46

The text-editing implementation in Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, does not check a node type before performing a cast, which has unspecified impact and attack vectors related to (1) DeleteS…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0179 Published 2010-08-24 Fixed

TI-2010-03112 CVE-2010-3255 · GHSA-cfrv-wvvp-3q9q

Google Chrome before 6.0.472.53 and webkitgtk before 1.2.6 do not properly handle counter…

MEDIUM 44

Google Chrome before 6.0.472.53 and webkitgtk before 1.2.6 do not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact vi…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.02013 Published 2010-09-07 Fixed CWE-119

TI-2010-04302 CVE-2010-4577 · GHSA-9j34-5qgm-c4jh

The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used…

MEDIUM 43

The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly par…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02209 Published 2010-12-22 Fixed CWE-125

TI-2010-03959 CVE-2010-4206 · GHSA-6jhm-3x88-7j24

Array index error in the FEBlend::apply function in…

MEDIUM 43

Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02516 Published 2010-11-05 Fixed CWE-787

TI-2010-03952 CVE-2010-4198 · GHSA-mr33-529g-h782

WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other…

MEDIUM 41

WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, does not properly handle large text areas, which allows remote attackers to cause a denial of service (memory corruption) or…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01501 Published 2010-11-05 Fixed CWE-20

TI-2010-01738 CVE-2010-1815 · GHSA-5r9c-8qr4-6vqw

Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod…

LOW 37

Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash)…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04406 Published 2010-09-09 Fixed CWE-399

TI-2010-01737 CVE-2010-1814 · GHSA-3x7h-rc2j-gvx2

WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6…

LOW 37

WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vector…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04216 Published 2010-09-09 Fixed CWE-119

TI-2010-01735 CVE-2010-1812 · GHSA-v7qg-mvfg-r79j

Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod…

LOW 37

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04406 Published 2010-09-09 Fixed CWE-399

TI-2010-03622 CVE-2010-3813 · GHSA-qv97-4m93-h342

The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in…

LOW 30

The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk b…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.02131 Published 2010-11-20 Fixed CWE-264

TI-2010-02977 CVE-2010-3115 · GHSA-ph5f-gjj4-8w92

Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, does not properly implement…

LOW 26

Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, does not properly implement the history feature, which might allow remote attackers to spoof the address bar via unspecified vectors.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0181 Published 2010-08-24 Fixed

TI-2010-03116 CVE-2010-3259 · GHSA-ch35-3h8w-gw7f

WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before…

LOW 23

WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allow…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.016 Published 2010-09-07 Fixed CWE-200