Skip to content
OpenAdvisories
Medium 2 exploited CVEs RLSA-2022:1777 30 CVEs

Moderate: webkit2gtk3 security, bug fix, and enhancement update

Published May 10, 2022 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.34.6). (BZ#1985042)

Security Fix(es):

* webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free (CVE-2022-22620)

* webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)

* webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)

* webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)

* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)

* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)

* webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)

* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)

* webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)

* webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)

* webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)

* webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)

* webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)

* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30934)

* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30936)

* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30951)

* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30952)

* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30953)

* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30954)

* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30984)

* webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create (CVE-2021-45481)

* webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)

* webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)

* webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript (CVE-2022-22589)

* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-22590)

* webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2022-22592)

* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)

* webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)

* webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)

* webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 webkit2gtk3 0:2.34.6-1.el8

Vulnerabilities 30

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1985042
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2017898
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2017901
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2017904
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2018573
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034347
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034368
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034373
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034376
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034378
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034381
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034383
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034386
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2034389
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2038907
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2040327
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2040329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2040331
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2041559
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2044521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2044528
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2044534
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2044538
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2044542
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2044551
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2044553
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2045291
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053179
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053181
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053185
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2056474
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2073903