ALSA-2021:1586 — Moderate: GNOME security, bug fix, and enhancement update

Summary

GNOME is the default desktop environment of AlmaLinux.

The following packages have been upgraded to a later upstream version: accountsservice (0.6.55), webkit2gtk3 (2.30.4). (BZ#1846376, BZ#1883304)

Security Fix(es):

* webkitgtk: type confusion may lead to arbitrary code execution (CVE-2020-9948)

* webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-9951)

* webkitgtk: out-of-bounds write may lead to code execution (CVE-2020-9983)

* webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-13543)

* webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-13584)

* glib2: insecure permissions for files and directories (CVE-2019-13012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 81

Release	Package	Fixed in
AlmaLinux · 8	accountsservice-devel	0.6.55-1.el8
AlmaLinux · 8	atkmm	2.24.2-7.el8
AlmaLinux · 8	atkmm-devel	2.24.2-7.el8
AlmaLinux · 8	atkmm-doc	2.24.2-7.el8
AlmaLinux · 8	cairomm	1.12.0-8.el8
AlmaLinux · 8	cairomm-devel	1.12.0-8.el8
AlmaLinux · 8	cairomm-doc	1.12.0-8.el8
AlmaLinux · 8	chrome-gnome-shell	10.1-7.el8
AlmaLinux · 8	dleyna-core	0.6.0-3.el8
AlmaLinux · 8	dleyna-server	0.6.0-3.el8
AlmaLinux · 8	enchant2	2.2.3-3.el8
AlmaLinux · 8	enchant2-devel	2.2.3-3.el8
AlmaLinux · 8	gamin	0.1.10-32.el8
AlmaLinux · 8	gamin-devel	0.1.10-32.el8
AlmaLinux · 8	geoclue2	2.5.5-2.el8
AlmaLinux · 8	geoclue2-demos	2.5.5-2.el8
AlmaLinux · 8	geoclue2-devel	2.5.5-2.el8
AlmaLinux · 8	geoclue2-libs	2.5.5-2.el8
AlmaLinux · 8	geocode-glib	3.26.0-3.el8
AlmaLinux · 8	geocode-glib-devel	3.26.0-3.el8
AlmaLinux · 8	gjs	1.56.2-5.el8
AlmaLinux · 8	gjs-devel	1.56.2-5.el8
AlmaLinux · 8	glib2-doc	2.56.4-9.el8
AlmaLinux · 8	glib2-static	2.56.4-9.el8
AlmaLinux · 8	glibmm24	2.56.0-2.el8
AlmaLinux · 8	glibmm24-devel	2.56.0-2.el8
AlmaLinux · 8	glibmm24-doc	2.56.0-2.el8
AlmaLinux · 8	gnome-boxes	3.36.5-8.el8
AlmaLinux · 8	gnome-photos	3.28.1-4.el8
AlmaLinux · 8	gnome-photos-tests	3.28.1-4.el8
AlmaLinux · 8	gnome-terminal	3.28.3-3.el8
AlmaLinux · 8	gnome-terminal-nautilus	3.28.3-3.el8
AlmaLinux · 8	gtk-doc	1.28-3.el8
AlmaLinux · 8	gtk2	2.24.32-5.el8
AlmaLinux · 8	gtk2-devel	2.24.32-5.el8
AlmaLinux · 8	gtk2-devel-docs	2.24.32-5.el8
AlmaLinux · 8	gtk2-immodule-xim	2.24.32-5.el8
AlmaLinux · 8	gtk2-immodules	2.24.32-5.el8
AlmaLinux · 8	gtkmm24	2.24.5-6.el8
AlmaLinux · 8	gtkmm24-devel	2.24.5-6.el8
AlmaLinux · 8	gtkmm24-docs	2.24.5-6.el8
AlmaLinux · 8	gtkmm30	3.22.2-3.el8
AlmaLinux · 8	gtkmm30-devel	3.22.2-3.el8
AlmaLinux · 8	gtkmm30-doc	3.22.2-3.el8
AlmaLinux · 8	gvfs	1.36.2-11.el8
AlmaLinux · 8	gvfs-afc	1.36.2-11.el8
AlmaLinux · 8	gvfs-afp	1.36.2-11.el8
AlmaLinux · 8	gvfs-archive	1.36.2-11.el8
AlmaLinux · 8	gvfs-client	1.36.2-11.el8
AlmaLinux · 8	gvfs-devel	1.36.2-11.el8
AlmaLinux · 8	gvfs-fuse	1.36.2-11.el8
AlmaLinux · 8	gvfs-goa	1.36.2-11.el8
AlmaLinux · 8	gvfs-gphoto2	1.36.2-11.el8
AlmaLinux · 8	gvfs-mtp	1.36.2-11.el8
AlmaLinux · 8	gvfs-smb	1.36.2-11.el8
AlmaLinux · 8	libdazzle	3.28.5-2.el8
AlmaLinux · 8	libdazzle-devel	3.28.5-2.el8
AlmaLinux · 8	libepubgen	0.1.0-3.el8
AlmaLinux · 8	libepubgen-devel	0.1.0-3.el8
AlmaLinux · 8	libsass	3.4.5-6.el8
AlmaLinux · 8	libsass-devel	3.4.5-6.el8
AlmaLinux · 8	libsigc++20	2.10.0-6.el8
AlmaLinux · 8	libsigc++20-devel	2.10.0-6.el8
AlmaLinux · 8	libsigc++20-doc	2.10.0-6.el8
AlmaLinux · 8	libvisual	1:0.4.0-25.el8
AlmaLinux · 8	libvisual-devel	1:0.4.0-25.el8
AlmaLinux · 8	mutter-devel	3.32.2-57.el8
AlmaLinux · 8	nautilus	3.28.1-15.el8
AlmaLinux · 8	nautilus-devel	3.28.1-15.el8
AlmaLinux · 8	nautilus-extensions	3.28.1-15.el8
AlmaLinux · 8	OpenEXR-devel	2.2.0-12.el8
AlmaLinux · 8	OpenEXR-libs	2.2.0-12.el8
AlmaLinux · 8	pangomm	2.40.1-6.el8
AlmaLinux · 8	pangomm-devel	2.40.1-6.el8
AlmaLinux · 8	pangomm-doc	2.40.1-6.el8
AlmaLinux · 8	soundtouch	2.0.0-3.el8
AlmaLinux · 8	soundtouch-devel	2.0.0-3.el8
AlmaLinux · 8	vala	0.40.19-2.el8
AlmaLinux · 8	vala-devel	0.40.19-2.el8
AlmaLinux · 8	woff2	1.0.2-5.el8
AlmaLinux · 8	woff2-devel	1.0.2-5.el8

Vulnerabilities 12

High 8.8

CVE-2021-30661 Exploited

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, i…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu Alpine

Sep 8, 2021
KEV Nov 3, 2021
High 8.8

CVE-2020-13543

A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted we…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Dec 3, 2020
High 8.8

CVE-2020-13584

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML we…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Dec 3, 2020
High 7.2

CVE-2020-16125 Public exploit

gdm3 would start gnome-initial-setup if it cannot contact accountservice

gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially derivatives) this could be be chained with an additional issue that could allow a lo…

GNOME GDM3 gdm3 gdm3 Debian Ubuntu

Nov 10, 2020
Unscored —

CVE-2019-13012

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_…

glib2.0 glib2.0 Debian Ubuntu

Jun 28, 2019
Unscored —

CVE-2020-9948

A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing mali…

Apple Safari qtwebkit-source qtwebkit-opensource-src Browsers Debian Ubuntu Alpine

Oct 16, 2020
Unscored —

CVE-2020-9951

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing ma…

Apple Safari qtwebkit-source qtwebkit-opensource-src Browsers Debian Ubuntu Alpine

Oct 16, 2020
Unscored —

CVE-2020-9983

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 14.0. Processin…

Apple Safari qtwebkit-source qtwebkit-opensource-src Browsers Debian Ubuntu Alpine

Oct 16, 2020
Unscored —

CVE-2021-1817

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, iOS …

Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-1820

A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.3, i…

Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-1825

An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 for Windo…

Apple macOS iOS and iPadOS watchOS Windows macOS iOS Browsers Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-1826

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS …

Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine

Sep 8, 2021

References

report
https://vulners.com/cve/CVE-2019-13012
report
https://vulners.com/cve/CVE-2020-13543
report
https://vulners.com/cve/CVE-2020-13584
report
https://vulners.com/cve/CVE-2020-16125
report
https://vulners.com/cve/CVE-2020-9948
report
https://vulners.com/cve/CVE-2020-9951
report
https://vulners.com/cve/CVE-2020-9983
report
https://vulners.com/cve/CVE-2021-1817
report
https://vulners.com/cve/CVE-2021-1820
report
https://vulners.com/cve/CVE-2021-1825
report
https://vulners.com/cve/CVE-2021-1826
report
https://vulners.com/cve/CVE-2021-30661

Moderate: GNOME security, bug fix, and enhancement update

Summary

Fixed packages 81

Vulnerabilities 12

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, i…

A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted we…

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML we…

gdm3 would start gnome-initial-setup if it cannot contact accountservice

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_…

A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing mali…

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing ma…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 14.0. Processin…

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, iOS …

A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.3, i…

An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 for Windo…

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS …

References