[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 31 Jan 2022 18:49:31 +0000
From: Carlos Alberto Lopez Perez <clopez@...lia.com>
To: webkit-gtk@...ts.webkit.org, webkit-wpe@...ts.webkit.org
Cc: security@...kit.org, distributor-list@...me.org,
oss-security@...ts.openwall.com, bugtraq@...urityfocus.com
Subject: Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
On 21/01/2022 16:53, Carlos Alberto Lopez Perez wrote:
> CVE-2022-XXXXX
> Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
> Credit to Martin Bajanik from fingerprintjs.com.
> Impact: A malicious website may exfiltrate data cross-origin.
> Description: A cross-origin issue existed with the IndexedDB. This
> was addressed with improved checking of security origins.
> Notes: There is a public PoC demonstrating this issue at
> https://safarileaks.com so this issue may have been actively
> exploited. We still don't know the CVE number that will be assigned
> to this issue. We will update this advisory once we know it.
The data for the above unknown CVE number is now updated with the info below:
CVE-2022-22594
Versions affected: WebKitGTK and WPE WebKit before 2.34.4.
Credit to Martin Bajanik of fingerprintjs.com.
Impact: A website may be able to track sensitive user information.
Description: A cross-origin issue in the IndexDB API was addressed
with improved input validation. Notes: There is a public PoC
demonstrating this issue at safarileaks.com so it may have been
actively exploited.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
