Red Hat Security Advisory: webkit2gtk3 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 30

• High 8.8
  CVE-2021-30952 Exploited

  An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021

  KEV Mar 5, 2026
• High 8.8
  CVE-2022-22620 Exploited Public exploit EPSS 16%

  A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS…

  Apple macOS Safari (v and ) qtwebkit-source macOS Browsers Debian Ubuntu Alpine
  Mar 18, 2022

  KEV Feb 11, 2022
• High 8.8
  CVE-2022-22637

  A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, wa…

  Apple watchOS tvOS Safari Browsers Debian Ubuntu Alpine
  Sep 23, 2022
• Unscored —
  CVE-2021-30809 Public exploit

  A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchO…

  Apple iOS and iPadOS watchOS tvOS iOS Browsers Debian Ubuntu Alpine
  Oct 28, 2021
• Unscored —
  CVE-2021-30818

  A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvO…

  Apple iOS and iPadOS watchOS tvOS iOS Browsers Debian Ubuntu Alpine
  Oct 28, 2021
• Unscored —
  CVE-2021-30823

  A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPad…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu Alpine
  Oct 28, 2021
• Unscored —
  CVE-2021-30836

  An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tv…

  Apple iOS and iPadOS watchOS tvOS iOS Debian Ubuntu Alpine
  Oct 28, 2021
• Unscored —
  CVE-2021-30846

  A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8,…

  Apple iOS and iPadOS watchOS tvOS iOS Browsers Debian Ubuntu Alpine
  Oct 19, 2021
• Unscored —
  CVE-2021-30848

  A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8,…

  Apple iOS and iPadOS Safari qtwebkit-source iOS Browsers Debian Ubuntu Alpine
  Oct 19, 2021
• Unscored —
  CVE-2021-30849

  Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPa…

  Apple iOS and iPadOS watchOS tvOS Windows iOS Browsers Debian Ubuntu Alpine
  Oct 19, 2021
• Unscored —
  CVE-2021-30851

  A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15, tvOS 15, watch…

  Apple iOS and iPadOS watchOS tvOS iOS Browsers Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30884

  The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS …

  Apple iOS and iPadOS watchOS tvOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30887

  A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPad…

  Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30888

  An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS…

  Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30889

  A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1, iOS …

  Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30890

  A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and …

  Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30897

  An issue existed in the specification for the resource timing API. The specification was updated and the updated specif…

  Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30934

  A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 1…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30936

  A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey …

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30951

  A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey …

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30953

  An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 15.2, macOS Monterey 12.…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30954

  A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-30984

  A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Saf…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Aug 24, 2021
• Unscored —
  CVE-2021-45481

  In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::creat…

  qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu Alpine
  Dec 25, 2021
• Unscored —
  CVE-2021-45482

  In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability …

  qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu Alpine
  Dec 25, 2021
• Unscored —
  CVE-2021-45483

  In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-…

  qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu Alpine
  Dec 25, 2021
• Unscored —
  CVE-2022-22589

  A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, wat…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Mar 18, 2022
• Unscored —
  CVE-2022-22590

  A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.3 and iPadOS 15.3, …

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Mar 18, 2022
• Unscored —
  CVE-2022-22592

  A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Mar 18, 2022
• Unscored —
  CVE-2022-22594

  A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 a…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu Alpine
  Mar 18, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1985042
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2017898
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2017901
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2017904
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2018573
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034373
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034378
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034381
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034389
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2038907
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2041559
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044534
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044538
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044551
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044553
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2045291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053179
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053181
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053185
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056474
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2073903
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1777.json
• report
  https://access.redhat.com/security/cve/CVE-2021-30809
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-30809
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-30809
• report
  https://access.redhat.com/security/cve/CVE-2021-30818