ALSA-2023:2256 — Important: webkit2gtk3 security and bug fix update

Summary

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42826)
* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23517)
* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23518)
* webkitgtk: buffer overflow issue was addressed with improved memory handling (CVE-2022-32886)
* webkitgtk: out-of-bounds write issue was addressed with improved bounds checking (CVE-2022-32888)
* webkitgtk: correctness issue in the JIT was addressed with improved checks (CVE-2022-32923)
* webkitgtk: issue was addressed with improved UI handling (CVE-2022-42799)
* webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2022-42823)
* webkitgtk: sensitive information disclosure issue (CVE-2022-42824)
* webkitgtk: memory disclosure issue was addressed with improved memory handling (CVE-2022-42852)
* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-42863)
* webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42867)
* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46691)
* webkitgtk: Same Origin Policy bypass issue (CVE-2022-46692)
* webkitgtk: logic issue leading to user information disclosure (CVE-2022-46698)
* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46699)
* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46700)
* webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild() (CVE-2023-25358)
* webkitgtk: heap-use-after-free in WebCore::RenderLayer::renderer() (CVE-2023-25360)
* webkitgtk: heap-use-after-free in WebCore::RenderLayer::setNextSibling() (CVE-2023-25361)
* webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps() (CVE-2023-25362)
* webkitgtk: heap-use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags() (CVE-2023-25363)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 4

Release	Package	Fixed in
AlmaLinux · 9	webkit2gtk3	2.38.5-1.el9
AlmaLinux · 9	webkit2gtk3-devel	2.38.5-1.el9
AlmaLinux · 9	webkit2gtk3-jsc	2.38.5-1.el9
AlmaLinux · 9	webkit2gtk3-jsc-devel	2.38.5-1.el9

Vulnerabilities 22

High 8.8

CVE-2022-32886

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7…

Apple iOS and iPadOS Safari iOS iOS Browsers Debian Ubuntu

Sep 20, 2022
High 8.8

CVE-2022-32888

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.7, ma…

Apple macOS watchOS qtwebkit-source macOS Debian Ubuntu

Nov 1, 2022
High 8.8

CVE-2022-42823

A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13,…

Apple macOS watchOS tvOS macOS Debian Ubuntu

Nov 1, 2022
High 8.8

CVE-2022-42863

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, …

Apple watchOS tvOS qtwebkit-source Debian Ubuntu

Dec 15, 2022
High 8.8

CVE-2022-42867 EPSS 35%

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, ma…

Apple watchOS tvOS qtwebkit-source Debian Ubuntu

Dec 15, 2022
High 8.8

CVE-2022-46691

A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, …

Apple watchOS tvOS qtwebkit-source Debian Ubuntu

Dec 15, 2022
High 8.8

CVE-2022-46699

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, …

Apple watchOS tvOS qtwebkit-source Debian Ubuntu

Dec 15, 2022
High 8.8

CVE-2022-46700

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, …

Apple watchOS tvOS qtwebkit-source Debian Ubuntu

Dec 15, 2022
High 8.8

CVE-2023-23517

The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Feb 27, 2023
High 8.8

CVE-2023-23518

The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Feb 27, 2023
High 8.8

CVE-2023-25358

A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu

Mar 2, 2023
High 8.8

CVE-2023-25360

A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute…

webkit2gtk webkitgtk wpewebkit Debian Ubuntu

Mar 2, 2023
High 8.8

CVE-2023-25361

A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to e…

webkit2gtk webkitgtk wpewebkit Debian Ubuntu

Mar 2, 2023
Medium 6.5

CVE-2022-32923

A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPa…

Apple macOS watchOS tvOS macOS Debian Ubuntu

Nov 1, 2022
Medium 6.5

CVE-2022-42852

The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.…

Apple watchOS tvOS qtwebkit-source Debian Ubuntu

Dec 15, 2022
Medium 6.5

CVE-2022-46698

A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.…

Apple watchOS tvOS iCloud for Windows Windows Debian Ubuntu

Dec 15, 2022
Medium 6.1

CVE-2022-42799

The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Saf…

Apple macOS watchOS tvOS macOS Debian Ubuntu

Nov 1, 2022
Medium 5.5

CVE-2022-42824

A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS…

Apple macOS watchOS tvOS macOS Debian Ubuntu

Nov 1, 2022
Medium 5.5

CVE-2022-46692

A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for W…

Apple watchOS tvOS iCloud for Windows Windows Debian Ubuntu

Dec 15, 2022
Unscored —

CVE-2022-42826

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1…

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu

Feb 27, 2023
Unscored —

CVE-2023-25362

A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows att…

webkit2gtk webkitgtk wpewebkit Debian Ubuntu

Mar 2, 2023
Unscored —

CVE-2023-25363

A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allow…

webkit2gtk webkitgtk wpewebkit Debian Ubuntu

Mar 2, 2023

References

report
https://access.redhat.com/security/cve/CVE-2022-32886
report
https://access.redhat.com/security/cve/CVE-2022-32888
report
https://access.redhat.com/security/cve/CVE-2022-32923
report
https://access.redhat.com/security/cve/CVE-2022-42799
report
https://access.redhat.com/security/cve/CVE-2022-42823
report
https://access.redhat.com/security/cve/CVE-2022-42824
report
https://access.redhat.com/security/cve/CVE-2022-42826
report
https://access.redhat.com/security/cve/CVE-2022-42852
report
https://access.redhat.com/security/cve/CVE-2022-42863
report
https://access.redhat.com/security/cve/CVE-2022-42867
report
https://access.redhat.com/security/cve/CVE-2022-46691
report
https://access.redhat.com/security/cve/CVE-2022-46692
report
https://access.redhat.com/security/cve/CVE-2022-46698
report
https://access.redhat.com/security/cve/CVE-2022-46699
report
https://access.redhat.com/security/cve/CVE-2022-46700
report
https://access.redhat.com/security/cve/CVE-2023-23517
report
https://access.redhat.com/security/cve/CVE-2023-23518
report
https://access.redhat.com/security/cve/CVE-2023-25358
report
https://access.redhat.com/security/cve/CVE-2023-25360
report
https://access.redhat.com/security/cve/CVE-2023-25361
report
https://access.redhat.com/security/cve/CVE-2023-25362
report
https://access.redhat.com/security/cve/CVE-2023-25363
report
https://bugzilla.redhat.com/2128643
report
https://bugzilla.redhat.com/2140501
report
https://bugzilla.redhat.com/2140502
report
https://bugzilla.redhat.com/2140503
report
https://bugzilla.redhat.com/2140504
report
https://bugzilla.redhat.com/2140505
report
https://bugzilla.redhat.com/2156986
report
https://bugzilla.redhat.com/2156987
report
https://bugzilla.redhat.com/2156989
report
https://bugzilla.redhat.com/2156990
report
https://bugzilla.redhat.com/2156991
report
https://bugzilla.redhat.com/2156992
report
https://bugzilla.redhat.com/2156993
report
https://bugzilla.redhat.com/2156994
report
https://bugzilla.redhat.com/2167715
report
https://bugzilla.redhat.com/2167716
report
https://bugzilla.redhat.com/2167717

Important: webkit2gtk3 security and bug fix update

Summary

Fixed packages 4

Vulnerabilities 22

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.7, ma…

A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13,…

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, …

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, ma…

A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, …

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, …

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, …

The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2…

The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2…

A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute…

A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute…

A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to e…

A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPa…

The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.…

A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.…

The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Saf…

A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS…

A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for W…

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1…

A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows att…

A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allow…

References