[Buildroot] [git commit branch/2017.02.x] webkitgtk: security bump to version 2.16.6

Peter Korsgaard peter at korsgaard.com
Wed Jul 26 20:52:28 UTC 2017


commit: https://git.buildroot.net/buildroot/commit/?id=25d4b5cf7894c5a274661dcb907cddecaa7299be
branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/2017.02.x

Fixes the following security issues:

CVE-2017-7018 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7030 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7034 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7037 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7039 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7046 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7048 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7055 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7056 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7061 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
tvOS before 10.2.2 is affected.  The issue involves the "WebKit" component.
It allows remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via a crafted web site.

CVE-2017-7064 - An issue was discovered in certain Apple products.  iOS
before 10.3.3 is affected.  Safari before 10.1.2 is affected.  iCloud before
6.2.2 on Windows is affected.  iTunes before 12.6.2 on Windows is affected.
The issue involves the "WebKit" component.  It allows attackers to bypass
intended memory-read restrictions via a crafted app.

For more details, see the announcement:
https://webkitgtk.org/2017/07/24/webkitgtk2.16.6-released.html

Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
Reviewed-by: "Adrian Perez de Castro" <aperez at igalia.com>
Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
(cherry picked from commit b5582d54a4e0035cf3b9cee57f10906276e8f4d6)
Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
---
 package/webkitgtk/webkitgtk.hash | 8 ++++----
 package/webkitgtk/webkitgtk.mk   | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package/webkitgtk/webkitgtk.hash b/package/webkitgtk/webkitgtk.hash
index 5df4ce8..2c0fc50 100644
--- a/package/webkitgtk/webkitgtk.hash
+++ b/package/webkitgtk/webkitgtk.hash
@@ -1,4 +1,4 @@
-# From https://webkitgtk.org/releases/webkitgtk-2.16.5.tar.xz.sums
-md5 fce72dc89cd310a663d9eb97133861fe webkitgtk-2.16.5.tar.xz
-sha1 8052fda41b1b666f175baaac787c5cba39ed24a0 webkitgtk-2.16.5.tar.xz
-sha256 8e0396f3428e757898c5856e642eed4fcd5a20ae03d96d3eaa03b76634be7dd4 webkitgtk-2.16.5.tar.xz
+# From https://webkitgtk.org/releases/webkitgtk-2.16.6.tar.xz.sums
+md5  0e2d142a586e4ff79cf0324f4fdbf20c webkitgtk-2.16.6.tar.xz
+sha1 f7fca3fbac3dc99e39f353a6df250635e684c922 webkitgtk-2.16.6.tar.xz
+sha256 fc23650df953123c59b9c0edf3855e7bd55bd107820997fc72375811e1ea4b21 webkitgtk-2.16.6.tar.xz
diff --git a/package/webkitgtk/webkitgtk.mk b/package/webkitgtk/webkitgtk.mk
index 187885a..8329d52 100644
--- a/package/webkitgtk/webkitgtk.mk
+++ b/package/webkitgtk/webkitgtk.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-WEBKITGTK_VERSION = 2.16.5
+WEBKITGTK_VERSION = 2.16.6
 WEBKITGTK_SITE = http://www.webkitgtk.org/releases
 WEBKITGTK_SOURCE = webkitgtk-$(WEBKITGTK_VERSION).tar.xz
 WEBKITGTK_INSTALL_STAGING = YES


More information about the buildroot mailing list