[월:] 2018년 01월

USN-3530-1: WebKitGTK+ vulnerabilities Ubuntu Security Notice USN-3530-1 11th January, 2018 webkit2gtk vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.10 Ubuntu 17.04 Ubuntu 16.04 LTS Summary WebKitGTK+ could be made to expose sensitive information. Software description webkit2gtk – Web content engine library for GTK+ Details It was discovered that speculative execution performed by modern CPUscould leak information through a timing side-channel attack, and thatthis could be exploited in web browser JavaScript engines. If a user weretricked in to opening a specially crafted website, an attacker couldpotentially exploit this to obtain sensitive information from otherdomains, bypassing same-origin restrictions. (CVE-2017-5753, CVE-2017-5715) Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 17.10: libwebkit2gtk-4.0-37 2.18.5-0ubuntu0.17.10.1 libjavascriptcoregtk-4.0-18 2.18.5-0ubuntu0.17.10.1 Ubuntu 17.04: libwebkit2gtk-4.0-37 2.18.5-0ubuntu0.17.04.1 libjavascriptcoregtk-4.0-18 2.18.5-0ubuntu0.17.04.1 Ubuntu 16.04 LTS: libwebkit2gtk-4.0-37 2.18.5-0ubuntu0.16.04.1 libjavascriptcoregtk-4.0-18 2.18.5-0ubuntu0.16.04.1 To [ more… ]