Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • T tails
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 1,014
    • Issues 1,014
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 28
    • Merge requests 28
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • tails
  • tails
  • Issues
  • #11051
Closed
Open
Issue created Feb 03, 2016 by garrettr@garrettr2 of 2 checklist items completed2/2 checklist items

Audit applications using WebKit ports in Tails

Originally created by @garrettr on #11051 (Redmine)

https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/

This blog post points out that the versions of WebKit bundled in popular Linux GUI libraries (QtWebKit and WebKitGTK) are often seriously behind in terms of receiving security fixes from upstream. It is good that Tails uses IceWeasel as the default browser, because it would be the most serious concern and fortunately it is not affected. However, there are a number of other applications that do use WebKitGTK, some of which may be included in Tails. Here’s an incomplete list from the blog post:

GIMP, Liferea (edited list to remove software that Tails doesn’t ship)

It would be good to audit Tails’ use of these programs (and any other programs that might use out-of-date WebKit) and evaluate whether this could lead to security vulnerabilities for Tails users.

Subtasks

  • #16313 (closed)

Related issues

  • Related to #14508
  • Blocked by #15776 (closed)
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking