Skip to content
OpenAdvisories
High 17 exploited CVEs ALAS2-2023-2088 100 CVEs

Important: webkitgtk4 security update (Amazon Linux 2)

Published Jun 7, 2023 · Updated Aug 28, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32409: N/A CVE-2023-32373: A use-after free bug in WebKit that could lead to arbitrary code execution when processing maliciously crafted web content. It was addressed with improved memory management. CVE-2023-28205: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.7.5 and iPadOS 15.7.5, Safari 16.4.1, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. CVE-2023-28204: An out-of-bounds read issue in WebKit that could be abused to disclose sensitive information when processing web content. It was addressed with improved input validation. CVE-2023-27954: The vulnerability exists due to excessive data output by the application. A remote attacker can track sensitive user information. CVE-2023-27932: The vulnerability allows a remote attacker to bypass Same Origin Policy restrictions. CVE-2023-25363: A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely. CVE-2023-25362: A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely. CVE-2023-25361: A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely. CVE-2023-25360: A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely. CVE-2023-25358: A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely. CVE-2023-23529: A vulnerability was found in WebKitGTK. This issue occurs when processing maliciously crafted web content in WebKit. This may, in theory, allow a remote attacker to create a specially crafted web page, trick the victim into opening it, trigger type confusion, and execute arbitrary code on the target system. CVE-2023-23518: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2023-23517: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2023-2203: A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. CVE-2022-46700: A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2022-46699: A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2022-46698: A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information. CVE-2022-46692: A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy. CVE-2022-46691: A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2022-42867: A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2022-42863: A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2022-42856: A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1.. CVE-2022-42852: The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory. CVE-2022-42826: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2022-42824: A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose sensitive user information. CVE-2022-42799: The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiting a malicious website may lead to user int

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 webkitgtk4 0:2.38.5-3.amzn2.0.1
Amazon Linux · 2 webkitgtk4-debuginfo 0:2.38.5-3.amzn2.0.1
Amazon Linux · 2 webkitgtk4-devel 0:2.38.5-3.amzn2.0.1
Amazon Linux · 2 webkitgtk4-jsc 0:2.38.5-3.amzn2.0.1
Amazon Linux · 2 webkitgtk4-jsc-devel 0:2.38.5-3.amzn2.0.1

Vulnerabilities 100

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-22592.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-27918.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-29623.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1765.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1788.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1789.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1799.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1801.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1817.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1820.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1825.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1826.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1844.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-1870.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-21775.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-21779.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-21806.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30661.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30663.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30665.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30666.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30682.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30689.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30720.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30734.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30744.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30749.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30758.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30761.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-30762.html