ALSA-2024:9636 — Important: webkit2gtk3 security update

Summary

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: Use after free in ANGLE (CVE-2024-4558)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-40789)
* webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40780)
* webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40779)
* webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management (CVE-2024-40782)
* webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)
* webkitgtk: A malicious website may cause unexpected cross-origin behavior (CVE-2024-23271)
* webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-27820)
* webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-27838)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2024-27851)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44185)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44244)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2024-44296)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

Release	Package	Fixed in
AlmaLinux · 8	webkit2gtk3	2.46.3-1.el8_10
AlmaLinux · 8	webkit2gtk3-devel	2.46.3-1.el8_10
AlmaLinux · 8	webkit2gtk3-jsc	2.46.3-1.el8_10
AlmaLinux · 8	webkit2gtk3-jsc-devel	2.46.3-1.el8_10

Vulnerabilities 21

Medium 5.5

CVE-2024-27834 Exploited

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

May 13, 2024
KEV Nov 4, 2026
Critical 9.8

CVE-2024-40782

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 an…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jul 29, 2024
High 8.8

CVE-2023-42950

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and …

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu Wolfi

Mar 28, 2024
High 8.8

CVE-2023-43010

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14…

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Mar 12, 2026
High 8.8

CVE-2024-54534

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iP…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu Wolfi

Dec 11, 2024
High 8.1

CVE-2025-43480

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
High 7.8

CVE-2024-27856

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jan 15, 2025
High 7.5

CVE-2024-27820

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 10, 2024
High 7.5

CVE-2024-27851

The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macO…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 10, 2024
High 7.5

CVE-2024-4558

Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap …

Google Chrome chromium chromium Browsers Debian Ubuntu Alpine Wolfi

May 7, 2024
High 7.3

CVE-2024-23271

A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS S…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Apr 24, 2024
Medium 6.5

CVE-2024-27838

The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, i…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 10, 2024
Medium 6.5

CVE-2024-40780

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and i…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jul 29, 2024
Medium 6.5

CVE-2024-40789

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jul 29, 2024
Medium 6.5

CVE-2024-40866

The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious webs…

Apple macOS Safari qtwebkit-source macOS Browsers Debian Ubuntu

Sep 16, 2024
Medium 6.5

CVE-2024-44187

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. Thi…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Sep 16, 2024
Medium 6.5

CVE-2024-54658

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, ma…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Feb 10, 2025
Medium 5.5

CVE-2024-40779

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and i…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jul 29, 2024
Medium 5.5

CVE-2024-44185

The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonom…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Oct 24, 2024
Medium 5.4

CVE-2024-44296

The issue was addressed with improved checks. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Oct 28, 2024
Medium 4.3

CVE-2024-44244

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 18.1, iOS 18.1 an…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Oct 28, 2024

References

report
https://access.redhat.com/security/cve/CVE-2024-23271
report
https://access.redhat.com/security/cve/CVE-2024-27820
report
https://access.redhat.com/security/cve/CVE-2024-27838
report
https://access.redhat.com/security/cve/CVE-2024-27851
report
https://access.redhat.com/security/cve/CVE-2024-40779
report
https://access.redhat.com/security/cve/CVE-2024-40780
report
https://access.redhat.com/security/cve/CVE-2024-40782
report
https://access.redhat.com/security/cve/CVE-2024-40789
report
https://access.redhat.com/security/cve/CVE-2024-40866
report
https://access.redhat.com/security/cve/CVE-2024-44185
report
https://access.redhat.com/security/cve/CVE-2024-44187
report
https://access.redhat.com/security/cve/CVE-2024-44244
report
https://access.redhat.com/security/cve/CVE-2024-44296
report
https://access.redhat.com/security/cve/CVE-2024-4558
report
https://bugzilla.redhat.com/2279689
report
https://bugzilla.redhat.com/2302067
report
https://bugzilla.redhat.com/2302069
report
https://bugzilla.redhat.com/2302070
report
https://bugzilla.redhat.com/2302071
report
https://bugzilla.redhat.com/2312724
report
https://bugzilla.redhat.com/2314696
report
https://bugzilla.redhat.com/2314698
report
https://bugzilla.redhat.com/2314702
report
https://bugzilla.redhat.com/2314704
report
https://bugzilla.redhat.com/2314706
report
https://bugzilla.redhat.com/2323263
report
https://bugzilla.redhat.com/2323278
report
https://bugzilla.redhat.com/2323289
advisory
https://errata.almalinux.org/8/ALSA-2024-9636.html
report
https://www.redhat.com/security/data/cve/CVE-2023-42950.html
report
https://www.redhat.com/security/data/cve/CVE-2023-43010.html
report
https://www.redhat.com/security/data/cve/CVE-2024-27834.html
report
https://www.redhat.com/security/data/cve/CVE-2024-27856.html
report
https://www.redhat.com/security/data/cve/CVE-2024-54534.html
report
https://www.redhat.com/security/data/cve/CVE-2024-54658.html
report
https://www.redhat.com/security/data/cve/CVE-2025-43480.html

Important: webkit2gtk3 security update

Summary

Fixed packages 4

Vulnerabilities 21

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 an…

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and …

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14…

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iP…

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe…

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.…

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8…

The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macO…

Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap …

A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS S…

The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, i…

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and i…

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7…

The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious webs…

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. Thi…

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, ma…

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and i…

The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonom…

The issue was addressed with improved checks. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.…

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 18.1, iOS 18.1 an…

References