Summary
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2023-40414)
* webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2023-42852)
* webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-23213)
* webkitgtk: Processing a file may lead to a denial of service or potentially disclose memory contents (CVE-2014-1745)
* webkitgtk: User password may be read aloud by a text-to-speech accessibility feature (CVE-2023-32359)
* webkitgtk: use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (CVE-2023-39928)
* webkitgtk: Processing web content may lead to a denial of service (CVE-2023-41983)
* webkitgtk: processing a malicious image may lead to a denial of service (CVE-2023-42883)
* webkitgtk: processing malicious web content may lead to arbitrary code execution (CVE-2023-42890)
* webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-23206)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | webkit2gtk3 | 0:2.42.5-1.el8 |
Vulnerabilities 10
-
Critical 9.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPa…
-
High 8.8
A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page…
-
High 8.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16…
-
High 8.8
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5…
-
High 7.1
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows …
-
Medium 6.5
An access issue was addressed with improved access restrictions. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPa…
-
Unscored —
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.2 and iPadOS…
-
Unscored —
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, Safari 17.1, iOS 16.7.…
-
Unscored —
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2 …
-
Unscored —
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 1…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2241400
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2254326
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2254327
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2269743
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2270141
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2270143
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2270151
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2271449
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2271453
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2271456