ELSA-2021-4381 — Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 8)

Summary

accountsservice
[0.6.55-2]
- Add support for user templates so user can specify default session
Resolves: #1812788

gdm
[40.0-14]
- Fix XDMCP
Resolves: #2004170
- Fix crash at shutdown
Related: #2004170

[40.0-13]
- Disable Wayland on HyperV
- Fix Xorg fallback
Related: #1998989

[40.0-12]
- Redisable on server chips since rebase
Related: #1909300

[40.0-11]
- Read session settings from users even if theyve never saved
before. Needed to support accountsservice templated user
defaults.
Related: #1812788

[40.0-10]
- Let customers using vendor nvidia driver choose wayland sessions
Resolves: #1962211
- Drop unused patches

[40.0-3]
- Disable network items on login screen
Resolves: #1935261

[40.0-2]
- Fix workaround for systemd bug thats breaking X11 fallback
Resolves: #1962049

[40.0-1]
- Rebase to 40.0
Resolves: #1909300

gnome-autoar
[0.2.3-2]
- CVE-2020-36241, CVE-2021-28650: Do not allow symlink in parents (rhbz#1928701)

gnome-calculator
[3.28.2-2]
- Allow disabling downloading by setting refresh interval to 0
Resolves: #1957705

gnome-control-center
[3.28.2-28]
- Update pt_BR translations
- Resolves: #1978612

gnome-online-accounts
[3.28.2-3]
- Disable the Facebook and Foursquare providers
Resolves: #1951086, #1952136

gnome-session
[3.28.1-13.0.1]
- Update kiosk-session subpackage with Oracle references [Orabug: 32095108]

[3.28.1-13]
- Add patch to tell grub boot was successful when user is
able to explicitly request shutdown/reboot.
Resolves: #1914925

[3.28.1-12]
- Introduce gnome-wayland session to allow users that use
Xorg on the login screen to try wayland for the user session.
Related: #1962211

[3.28.1-11]
- Exclude kiosk-session from xsession subpackage
- Disable VT switching when kiosk-session is installed
Related: #1955754

gnome-settings-daemon
[3.32.0-16]
- Update pt_BR translations
- Resolves: #1978612

[3.32.0-15]
- Keep auto-logout working inside VMs
Resolves: #1904139

gnome-shell
[3.32.2-40]
- Add bugs introduced in backport for #1651378
Related: #1999758
- Tidy up patch list a bit

[3.32.2-39]
- Allow extensions on the login screen
Related: #1651378

[3.32.2-38]
- Only mask text in password entries
Resolves: #1987233

[3.32.2-37]
- Only warn once when not running under GDM
Resolves: #1980661

[3.32.2-36]
- Add ability to lock down password showing
Resolves: #1770302
- Add requires on newer mutter version
Related: #1937866

[3.32.2-35]
- Improve style of window preview close buttons
Resolves: #1981420

[3.32.2-34]
- Add PolicyKit-authentication-agent virtual provides
Resolves: #1978287

[3.32.2-33]
- Fix warnings on unlock
Resolves: #1971534
- Fix gdm lock screen
Resolves: #1971507

[3.32.2-32]
- Fix network secret requests on login screen
Related: #1935261

[3.32.2-31]
- Backport of touch mode
Resolves: #1937866

gnome-shell-extensions
[3.32.1-20]
- Add extension for displaying heads up message
Related: #1651378

[3.32.1-19]
- Dont use status icon wm_class as top bar role
Resolves: #1897932

[3.32.1-18]
- Add gesture-inhibitor extension
Resolves: #1854679

[3.32.1-17]
- Handle touchscreens on Wayland in the desktop-icons extension
Resolves: #1924725

[3.32.1-16]
- Fix opening files with (wrongly) set executable bit
Resolves: #1813727

gnome-software
[3.36.1-10]
- Resolves: #1978505 (Development package is missing important header files)

[3.36.1-9]
- Resolves: #1972545 (flatpak: Prefer runtime from the same origin as the application)

[3.36.1-8]
- Resolves: #1888404 (Updates page hides ongoing updates on refresh)

[3.36.1-7]
- Resolves: #1873297 (Crash when run as root)

[3.36.1-6]
- Resolves: #1791478 (Cannot completely disable ODRS (GNOME Ratings))

gsettings-desktop-schemas
[3.32.0-6]
- Add setting for locking down Show Password in entries
Related: #1770302

gtk3
[3.22.30-8]
- Make reftests work in a vm

[3.22.30-7]
- Only mention Emoji in context menus when requested (rhbz#1893196)
- Fix warnings from non-overlay scrollbars (rhbz#1873488)

LibRaw
[0.19.5-3]
- Backport fix for CVE-2020-24870 from upstream
Resolves: #1931841

mutter
[3.32.2-60]
- Backport fix avoiding DND regression
Resolves: #1999120

[3.32.2-59]
- Backport fixes avoiding frozen partly off-screen clients
Resolves: #1989035

[3.32.2-58]
- Backport xauth and xhost patches
Resolves: #1949176

vino
[3.22.0-11]
- Fix crashes under FIPS
- Resolves: #1960705

webkit2gtk3
[2.32.3-2]
- Fix CVE-2021-30858
- Resolves: #2006428

[2.32.3-1]
- Update to 2.32.3
- Related: #1937416

[2.32.2-1]
- Update to 2.32.2
- Related: #1937416

[2.32.1-1]
- Update to 2.32.1
- Related: #1937416

[2.32.0-1]
- Update to 2.32.0
- Related: #1937416

Fixed packages 57

Release	Package	Fixed in
Oracle Linux · 8	accountsservice	0:0.6.55-2.el8
Oracle Linux · 8	accountsservice-devel	0:0.6.55-2.el8
Oracle Linux · 8	accountsservice-libs	0:0.6.55-2.el8
Oracle Linux · 8	gdm	1:40.0-15.el8
Oracle Linux · 8	gnome-autoar	0:0.2.3-2.el8
Oracle Linux · 8	gnome-calculator	0:3.28.2-2.el8
Oracle Linux · 8	gnome-classic-session	0:3.32.1-20.el8
Oracle Linux · 8	gnome-control-center	0:3.28.2-28.el8
Oracle Linux · 8	gnome-control-center-filesystem	0:3.28.2-28.el8
Oracle Linux · 8	gnome-online-accounts	0:3.28.2-3.el8
Oracle Linux · 8	gnome-online-accounts-devel	0:3.28.2-3.el8
Oracle Linux · 8	gnome-session	0:3.28.1-13.0.1.el8
Oracle Linux · 8	gnome-session-kiosk-session	0:3.28.1-13.0.1.el8
Oracle Linux · 8	gnome-session-wayland-session	0:3.28.1-13.0.1.el8
Oracle Linux · 8	gnome-session-xsession	0:3.28.1-13.0.1.el8
Oracle Linux · 8	gnome-settings-daemon	0:3.32.0-16.el8
Oracle Linux · 8	gnome-shell	0:3.32.2-40.el8
Oracle Linux · 8	gnome-shell-extension-apps-menu	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-auto-move-windows	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-common	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-dash-to-dock	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-desktop-icons	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-disable-screenshield	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-drive-menu	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-gesture-inhibitor	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-horizontal-workspaces	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-launch-new-instance	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-native-window-placement	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-no-hot-corner	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-panel-favorites	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-places-menu	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-screenshot-window-sizer	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-systemMonitor	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-top-icons	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-updates-dialog	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-user-theme	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-window-grouper	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-window-list	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-windowsNavigator	0:3.32.1-20.el8
Oracle Linux · 8	gnome-shell-extension-workspace-indicator	0:3.32.1-20.el8
Oracle Linux · 8	gnome-software	0:3.36.1-10.el8
Oracle Linux · 8	gnome-software-devel	0:3.36.1-10.el8
Oracle Linux · 8	gsettings-desktop-schemas	0:3.32.0-6.el8
Oracle Linux · 8	gsettings-desktop-schemas-devel	0:3.32.0-6.el8
Oracle Linux · 8	gtk-update-icon-cache	0:3.22.30-8.el8
Oracle Linux · 8	gtk3	0:3.22.30-8.el8
Oracle Linux · 8	gtk3-devel	0:3.22.30-8.el8
Oracle Linux · 8	gtk3-immodule-xim	0:3.22.30-8.el8
Oracle Linux · 8	LibRaw	0:0.19.5-3.el8
Oracle Linux · 8	LibRaw-devel	0:0.19.5-3.el8
Oracle Linux · 8	mutter	0:3.32.2-60.el8
Oracle Linux · 8	mutter-devel	0:3.32.2-60.el8
Oracle Linux · 8	vino	0:3.22.0-11.el8
Oracle Linux · 8	webkit2gtk3	0:2.32.3-2.el8
Oracle Linux · 8	webkit2gtk3-devel	0:2.32.3-2.el8
Oracle Linux · 8	webkit2gtk3-jsc	0:2.32.3-2.el8
Oracle Linux · 8	webkit2gtk3-jsc-devel	0:2.32.3-2.el8

Vulnerabilities 29

Critical 9.8

CVE-2021-1870 Exploited

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-1871 Exploited

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-1789 Exploited EPSS 14%

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security …

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
KEV May 4, 2022
High 8.8

CVE-2021-30665 Exploited

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.…

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Alpine

Sep 8, 2021
KEV Nov 3, 2021
High 7.8

CVE-2021-30663 Exploited

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, …

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Alpine

Sep 8, 2021
KEV Nov 3, 2021
High 8.8

CVE-2020-13558

A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A s…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Mar 3, 2021
High 8.8

CVE-2021-21806

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML we…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Jul 8, 2021
Medium 6.8

CVE-2021-21775

A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitG…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Jul 7, 2021
Medium 6.8

CVE-2021-21779

A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Jul 8, 2021
Unscored —

CVE-2020-24870

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

kodi dcraw libraw rawtherapee Debian Ubuntu

Jun 2, 2021
Unscored —

CVE-2020-27918

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watc…

Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine

Dec 8, 2020
Unscored —

CVE-2020-29623

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This i…

Apple macOS iOS and iPadOS tvOS macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2020-36241

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Di…

gnome-autoar gnome-autoar gnome-autoar Debian Ubuntu Alpine

Feb 5, 2021
Unscored —

CVE-2021-1765

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security …

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-1788

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Securi…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-1799

A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Secu…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-1801

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security …

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-1844

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, …

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-28650

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Dir…

gnome-autoar gnome-autoar gnome-autoar Debian Ubuntu Alpine

Mar 17, 2021
Unscored —

CVE-2021-30682 Public exploit

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30689

A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6,…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30720

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30734

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 1…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30744

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This i…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30749

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 1…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30758

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari 14.1.2, macO…

Apple macOS iOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30795

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7, Safari 14.1.2, m…

Apple macOS iOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30797

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watc…

Apple macOS iOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30799

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.7, macOS …

Apple macOS iOS Security Update - Catalina macOS iOS Debian Ubuntu Alpine

Sep 8, 2021

Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 57

Vulnerabilities 29

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security …

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.…

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, …

A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A s…

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML we…

A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitG…

A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A…

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watc…

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This i…

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Di…

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security …

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Securi…

A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Secu…

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security …

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, …

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Dir…

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…

A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6,…

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 1…

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This i…

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 1…

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari 14.1.2, macO…

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7, Safari 14.1.2, m…

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watc…

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.7, macOS …