Skip to content
OpenAdvisories
Medium ALAS2-2024-2516 3 CVEs

Moderate: webkitgtk4 security update (Amazon Linux 2)

Published Apr 11, 2024 · Updated Apr 15, 2024

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23284: A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. CVE-2024-23263: A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. CVE-2023-42956: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2. Processing web content may lead to a denial-of-service.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 webkitgtk4 0:2.42.5-1.amzn2.0.3
Amazon Linux · 2 webkitgtk4-debuginfo 0:2.42.5-1.amzn2.0.3
Amazon Linux · 2 webkitgtk4-devel 0:2.42.5-1.amzn2.0.3
Amazon Linux · 2 webkitgtk4-jsc 0:2.42.5-1.amzn2.0.3
Amazon Linux · 2 webkitgtk4-jsc-devel 0:2.42.5-1.amzn2.0.3

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-42956.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23263.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23284.html