Summary
GNOME is the default desktop environment of AlmaLinux.
The following packages have been upgraded to a later upstream version: gnome-remote-desktop (0.1.8), pipewire (0.3.6), vte291 (0.52.4), webkit2gtk3 (2.28.4), xdg-desktop-portal (1.6.0), xdg-desktop-portal-gtk (1.6.0). (BZ#1775345, BZ#1779691, BZ#1817143, BZ#1832347, BZ#1837406)
Security Fix(es):
* webkitgtk: Multiple security issues (CVE-2019-8625, CVE-2019-8710, CVE-2019-8720, CVE-2019-8743, CVE-2019-8764, CVE-2019-8766, CVE-2019-8769, CVE-2019-8771, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846, CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, CVE-2020-3885, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806, CVE-2020-9807, CVE-2020-9843, CVE-2020-9850, CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925, CVE-2020-10018, CVE-2020-11793)
* gnome-settings-daemon: AlmaLinux Customer Portal password logged and passed as command line argument when user registers through GNOME control center (CVE-2020-14391)
* LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 38
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | dleyna-renderer | 0.6.0-3.el8 |
| AlmaLinux · 8 | frei0r-devel | 1.6.1-7.el8 |
| AlmaLinux · 8 | frei0r-plugins | 1.6.1-7.el8 |
| AlmaLinux · 8 | frei0r-plugins-opencv | 1.6.1-7.el8 |
| AlmaLinux · 8 | gnome-remote-desktop | 0.1.8-3.el8 |
| AlmaLinux · 8 | gtk-doc | 1.28-2.el8 |
| AlmaLinux · 8 | gvfs | 1.36.2-10.el8 |
| AlmaLinux · 8 | LibRaw-devel | 0.19.5-2.el8 |
| AlmaLinux · 8 | libsoup | 2.62.3-2.el8 |
| AlmaLinux · 8 | libsoup-devel | 2.62.3-2.el8 |
| AlmaLinux · 8 | mutter-devel | 3.32.2-48.el8 |
| AlmaLinux · 8 | nautilus | 3.28.1-14.el8 |
| AlmaLinux · 8 | nautilus-devel | 3.28.1-14.el8 |
| AlmaLinux · 8 | PackageKit | 1.1.12-6.el8 |
| AlmaLinux · 8 | PackageKit-command-not-found | 1.1.12-6.el8 |
| AlmaLinux · 8 | PackageKit-cron | 1.1.12-6.el8 |
| AlmaLinux · 8 | PackageKit-glib | 1.1.12-6.el8 |
| AlmaLinux · 8 | PackageKit-glib-devel | 1.1.12-6.el8 |
| AlmaLinux · 8 | PackageKit-gstreamer-plugin | 1.1.12-6.el8 |
| AlmaLinux · 8 | PackageKit-gtk3-module | 1.1.12-6.el8 |
| AlmaLinux · 8 | pipewire | 0.3.6-1.el8 |
| AlmaLinux · 8 | pipewire-devel | 0.3.6-1.el8 |
| AlmaLinux · 8 | pipewire-doc | 0.3.6-1.el8 |
| AlmaLinux · 8 | pipewire-libs | 0.3.6-1.el8 |
| AlmaLinux · 8 | pipewire-utils | 0.3.6-1.el8 |
| AlmaLinux · 8 | pipewire0.2-devel | 0.2.7-6.el8 |
| AlmaLinux · 8 | pipewire0.2-libs | 0.2.7-6.el8 |
| AlmaLinux · 8 | potrace | 1.15-3.el8 |
| AlmaLinux · 8 | pygobject3-devel | 3.28.3-2.el8 |
| AlmaLinux · 8 | python3-gobject | 3.28.3-2.el8 |
| AlmaLinux · 8 | python3-gobject-base | 3.28.3-2.el8 |
| AlmaLinux · 8 | tracker | 2.1.5-2.el8 |
| AlmaLinux · 8 | tracker-devel | 2.1.5-2.el8 |
| AlmaLinux · 8 | vte-profile | 0.52.4-2.el8 |
| AlmaLinux · 8 | vte291 | 0.52.4-2.el8 |
| AlmaLinux · 8 | vte291-devel | 0.52.4-2.el8 |
| AlmaLinux · 8 | webrtc-audio-processing | 0.3-9.el8 |
| AlmaLinux · 8 | xdg-desktop-portal-gtk | 1.6.0-1.el8 |
Vulnerabilities 57
-
High 8.8CVE-2019-8720 Exploited
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lea…
KEV May 23, 2022 -
High 8.8CVE-2021-30666 Exploited
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing mali…
KEV Nov 3, 2021 -
High 8.8
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing m…
KEV Nov 3, 2021 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing mal…
KEV Nov 3, 2021 -
High 8.8CVE-2020-9802 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, w…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1,…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iCloud for Windo…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Pro…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in watchOS 6.1. Processing maliciously …
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1, iCl…
-
Unscored —
An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This issue is fixed …
-
Unscored —
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Malici…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —CVE-2019-8820 Public exploit
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, iClou…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, watch…
-
Unscored —
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 13.3, iCloud for Wind…
-
Unscored —
WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory c…
-
Unscored —
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allo…
-
Unscored —
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly u…
-
Unscored —
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_i…
-
Unscored —
A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.…
-
Unscored —
A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 fo…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and i…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 1…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and i…
-
Unscored —
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Saf…
-
Unscored —
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, …
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4,…
-
Unscored —
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tv…
-
Unscored —
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4…
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4,…
-
Unscored —
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tv…
-
Unscored —
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4…
-
Unscored —
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS…
-
Unscored —
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, w…
-
Unscored —
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5…
-
Unscored —
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5…
-
Unscored —
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5…
-
Unscored —
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, w…
-
Unscored —
A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixe…
-
Unscored —
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, …
-
Unscored —
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, tv…
-
Unscored —
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, …
-
Unscored —
An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions. This is…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.…
-
Unscored —
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0…
References
-
report
https://vulners.com/cve/CVE-2019-8625
-
report
https://vulners.com/cve/CVE-2019-8710
-
report
https://vulners.com/cve/CVE-2019-8720
-
report
https://vulners.com/cve/CVE-2019-8743
-
report
https://vulners.com/cve/CVE-2019-8764
-
report
https://vulners.com/cve/CVE-2019-8766
-
report
https://vulners.com/cve/CVE-2019-8769
-
report
https://vulners.com/cve/CVE-2019-8771
-
report
https://vulners.com/cve/CVE-2019-8782
-
report
https://vulners.com/cve/CVE-2019-8783
-
report
https://vulners.com/cve/CVE-2019-8808
-
report
https://vulners.com/cve/CVE-2019-8811
-
report
https://vulners.com/cve/CVE-2019-8812
-
report
https://vulners.com/cve/CVE-2019-8813
-
report
https://vulners.com/cve/CVE-2019-8814
-
report
https://vulners.com/cve/CVE-2019-8815
-
report
https://vulners.com/cve/CVE-2019-8816
-
report
https://vulners.com/cve/CVE-2019-8819
-
report
https://vulners.com/cve/CVE-2019-8820
-
report
https://vulners.com/cve/CVE-2019-8823
-
report
https://vulners.com/cve/CVE-2019-8835
-
report
https://vulners.com/cve/CVE-2019-8844
-
report
https://vulners.com/cve/CVE-2019-8846
-
report
https://vulners.com/cve/CVE-2020-10018
-
report
https://vulners.com/cve/CVE-2020-11793
-
report
https://vulners.com/cve/CVE-2020-14391
-
report
https://vulners.com/cve/CVE-2020-15503
-
report
https://vulners.com/cve/CVE-2020-3862
-
report
https://vulners.com/cve/CVE-2020-3864
-
report
https://vulners.com/cve/CVE-2020-3865
-
report
https://vulners.com/cve/CVE-2020-3867
-
report
https://vulners.com/cve/CVE-2020-3868
-
report
https://vulners.com/cve/CVE-2020-3885
-
report
https://vulners.com/cve/CVE-2020-3894
-
report
https://vulners.com/cve/CVE-2020-3895
-
report
https://vulners.com/cve/CVE-2020-3897
-
report
https://vulners.com/cve/CVE-2020-3899
-
report
https://vulners.com/cve/CVE-2020-3900
-
report
https://vulners.com/cve/CVE-2020-3901