RHSA-2021:4381 — Red Hat Security Advisory: GNOME security, bug fix, and enhancement update

Fixed packages 20

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	gnome-autoar	0:0.2.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	gnome-autoar-debuginfo	0:0.2.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	gnome-autoar-debugsource	0:0.2.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	LibRaw	0:0.19.5-3.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	LibRaw-debuginfo	0:0.19.5-3.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	LibRaw-debugsource	0:0.19.5-3.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	LibRaw-samples-debuginfo	0:0.19.5-3.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-debuginfo	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-debugsource	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-devel	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-devel-debuginfo	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-jsc	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-jsc-debuginfo	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-jsc-devel	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-jsc-devel-debuginfo	0:2.32.3-2.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	LibRaw-debuginfo	0:0.19.5-3.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	LibRaw-debugsource	0:0.19.5-3.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	LibRaw-devel	0:0.19.5-3.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	LibRaw-samples-debuginfo	0:0.19.5-3.el8

Vulnerabilities 29

Critical 9.8

CVE-2021-1870 Exploited

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-1871 Exploited

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-1789 Exploited EPSS 14%

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security …

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
KEV May 4, 2022
High 8.8

CVE-2021-30665 Exploited

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.…

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Alpine

Sep 8, 2021
KEV Nov 3, 2021
High 7.8

CVE-2021-30663 Exploited

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, …

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Alpine

Sep 8, 2021
KEV Nov 3, 2021
High 8.8

CVE-2020-13558

A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A s…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Mar 3, 2021
High 8.8

CVE-2021-21806

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML we…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Jul 8, 2021
Medium 6.8

CVE-2021-21775

A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitG…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Jul 7, 2021
Medium 6.8

CVE-2021-21779

A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A…

qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Browsers Debian Ubuntu Alpine

Jul 8, 2021
Unscored —

CVE-2020-24870

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

kodi dcraw libraw rawtherapee Debian Ubuntu

Jun 2, 2021
Unscored —

CVE-2020-27918

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watc…

Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine

Dec 8, 2020
Unscored —

CVE-2020-29623

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This i…

Apple macOS iOS and iPadOS tvOS macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2020-36241

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Di…

gnome-autoar gnome-autoar gnome-autoar Debian Ubuntu Alpine

Feb 5, 2021
Unscored —

CVE-2021-1765

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security …

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-1788

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Securi…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-1799

A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Secu…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-1801

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security …

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-1844

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, …

Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu Alpine

Apr 2, 2021
Unscored —

CVE-2021-28650

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Dir…

gnome-autoar gnome-autoar gnome-autoar Debian Ubuntu Alpine

Mar 17, 2021
Unscored —

CVE-2021-30682 Public exploit

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30689

A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6,…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30720

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30734

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 1…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30744

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This i…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30749

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 1…

Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30758

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari 14.1.2, macO…

Apple macOS iOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30795

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7, Safari 14.1.2, m…

Apple macOS iOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30797

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watc…

Apple macOS iOS qtwebkit-source macOS iOS Debian Ubuntu Alpine

Sep 8, 2021
Unscored —

CVE-2021-30799

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.7, macOS …

Apple macOS iOS Security Update - Catalina macOS iOS Debian Ubuntu Alpine

Sep 8, 2021

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1651378
report
https://bugzilla.redhat.com/show_bug.cgi?id=1770302
report
https://bugzilla.redhat.com/show_bug.cgi?id=1791478
report
https://bugzilla.redhat.com/show_bug.cgi?id=1813727
report
https://bugzilla.redhat.com/show_bug.cgi?id=1854679
report
https://bugzilla.redhat.com/show_bug.cgi?id=1873297
report
https://bugzilla.redhat.com/show_bug.cgi?id=1873488
report
https://bugzilla.redhat.com/show_bug.cgi?id=1888404
report
https://bugzilla.redhat.com/show_bug.cgi?id=1894613
report
https://bugzilla.redhat.com/show_bug.cgi?id=1897932
report
https://bugzilla.redhat.com/show_bug.cgi?id=1904139
report
https://bugzilla.redhat.com/show_bug.cgi?id=1905000
report
https://bugzilla.redhat.com/show_bug.cgi?id=1909300
report
https://bugzilla.redhat.com/show_bug.cgi?id=1914925
report
https://bugzilla.redhat.com/show_bug.cgi?id=1924725
report
https://bugzilla.redhat.com/show_bug.cgi?id=1925640
report
https://bugzilla.redhat.com/show_bug.cgi?id=1928794
report
https://bugzilla.redhat.com/show_bug.cgi?id=1928886
report
https://bugzilla.redhat.com/show_bug.cgi?id=1935261
report
https://bugzilla.redhat.com/show_bug.cgi?id=1937416
report
https://bugzilla.redhat.com/show_bug.cgi?id=1937866
report
https://bugzilla.redhat.com/show_bug.cgi?id=1938937
report
https://bugzilla.redhat.com/show_bug.cgi?id=1940026
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944323
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944329
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944333
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944337
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944340
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944343
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944350
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944859
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944862
report
https://bugzilla.redhat.com/show_bug.cgi?id=1944867
report
https://bugzilla.redhat.com/show_bug.cgi?id=1949176
report
https://bugzilla.redhat.com/show_bug.cgi?id=1951086
report
https://bugzilla.redhat.com/show_bug.cgi?id=1952136
report
https://bugzilla.redhat.com/show_bug.cgi?id=1955754

Red Hat Security Advisory: GNOME security, bug fix, and enhancement update

Fixed packages 20

Vulnerabilities 29

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security …

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.…

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, …

A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A s…

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML we…

A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitG…

A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A…

Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watc…

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This i…

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Di…

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security …

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Securi…

A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Secu…

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security …

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, …

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Dir…

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…

A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6,…

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 1…

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This i…

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 1…

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari 14.1.2, macO…

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7, Safari 14.1.2, m…

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watc…

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.7, macOS …

References