[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Oct 2021 16:40:55 +0200
From: Samuel Groß <saelo@...gle.com>
To: Francis Perron <francis.perron@...pify.com>
Cc: oss-security@...ts.openwall.com,
Carlos Alberto Lopez Perez <clopez@...lia.com>, security@...kit.org, Alberto Garcia <berto@...lia.com>
Subject: Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
Hi!
I don't know what happened to CVE-2021-30851 as these CVEs are allocated by
Apple usually. I think the CVE would correspond to this issue though:
https://bugs.webkit.org/show_bug.cgi?id=227988
Best!
Samuel
On Wed, Oct 27, 2021 at 3:02 PM Francis Perron <francis.perron@...pify.com>
wrote:
> On Wed, Oct 27, 2021 at 12:09 AM Salvatore Bonaccorso <carnil@...ian.org>
> wrote:
> >
> > Hi,
> >
> > [dropping most other recipients]
> >
> > On Tue, Oct 26, 2021 at 08:05:36PM +0100, Carlos Alberto Lopez Perez
> wrote:
> > >
> ------------------------------------------------------------------------
> > > WebKitGTK and WPE WebKit Security Advisory
> WSA-2021-0006
> > >
> ------------------------------------------------------------------------
> > >
> > > Date reported : October 26, 2021
> > > Advisory ID : WSA-2021-0006
> > > WebKitGTK Advisory URL :
> https://webkitgtk.org/security/WSA-2021-0006.html
> > > WPE WebKit Advisory URL :
> https://wpewebkit.org/security/WSA-2021-0006.html
> > > CVE identifiers : CVE-2021-30846, CVE-2021-30848,
> > > CVE-2021-30849, CVE-2021-30851,
> > > CVE-2021-30858, CVE-2021-42762.
> > >
> > > Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.
> > [...]
> > > CVE-2021-30851
> > > Versions affected: WebKitGTK and WPE WebKit before 2.34.0.
> > > Credit to Samuel Groß of Google Project Zero.
> > > Impact: Processing maliciously crafted web content may lead to code
> > > execution. Description: A memory corruption vulnerability was
> > > addressed with improved locking.
> >
> > CVE-2021-30851 seems to be REJECTED (cf.
> > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30851). Is
> > there a typo in the CVE id for this one or did the CVE got rejected
> > later on?
>
> BCC'ing Samuel Groß
>
>
> Salvatore -
> I think 30851 was not issued, and it may have been a mistake here.
> There was no other CVE issued as part of WSA-2021-0006 according to
> the GitHub repo for the CVE program:
> https://github.com/CVEProject/cvelist/search?q=wsa-2021-0006
>
> if you need a CVE for this, Samuel may be able to sort this out with
> the WebKit folks, who also seem to advertise 30851 on their security
> advisory site: https://webkitgtk.org/security/WSA-2021-0006.html
>
>
> Have a good Wednesday,
>
> --
> Francis Perron
> Engineering Program Manager | Security Incident Response
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
