SUSE-SU-2023:0061-1

Опубликовано: 10 янв. 2023

Источник: suse-cvrf

Описание

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues:

Update to version 2.38.3 (bnc#1206750):

CVE-2022-42852: Fixed disclosure of process memory by improved memory handling.
CVE-2022-42856: Fixed a potential arbitrary code execution when processing maliciously crafted web content (bsc#1206474).
CVE-2022-42863: Fixed a potential arbitrary code execution when processing maliciously crafted web content.
CVE-2022-42867: Fixed a use after free issue was addressed with improved memory management.
CVE-2022-46691: Fixed a potential arbitrary code execution when processing maliciously crafted web content.
CVE-2022-46692: Fixed bypass of Same Origin Policy through improved state management.
CVE-2022-46698: Fixed disclosure of sensitive user information with improved checks.
CVE-2022-46699: Fixed an arbitrary code execution caused by memory corruption.
CVE-2022-46700: Fixed a potential arbitrary code execution when processing maliciously crafted web content.

Список пакетов

SUSE Linux Enterprise Server 12 SP2-BCL

libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

libwebkit2gtk-4_0-37-2.38.3-2.123.1

libwebkit2gtk3-lang-2.38.3-2.123.1

typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2WebExtension-4_0-2.38.3-2.123.1

webkit2gtk-4_0-injected-bundles-2.38.3-2.123.1

webkit2gtk3-devel-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP4-LTSS

libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

libwebkit2gtk-4_0-37-2.38.3-2.123.1

libwebkit2gtk3-lang-2.38.3-2.123.1

typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2WebExtension-4_0-2.38.3-2.123.1

webkit2gtk-4_0-injected-bundles-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP5

libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

libwebkit2gtk-4_0-37-2.38.3-2.123.1

libwebkit2gtk3-lang-2.38.3-2.123.1

typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2WebExtension-4_0-2.38.3-2.123.1

webkit2gtk-4_0-injected-bundles-2.38.3-2.123.1

SUSE Linux Enterprise Server for SAP Applications 12 SP4

libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

libwebkit2gtk-4_0-37-2.38.3-2.123.1

libwebkit2gtk3-lang-2.38.3-2.123.1

typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2WebExtension-4_0-2.38.3-2.123.1

webkit2gtk-4_0-injected-bundles-2.38.3-2.123.1

SUSE Linux Enterprise Server for SAP Applications 12 SP5

libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

libwebkit2gtk-4_0-37-2.38.3-2.123.1

libwebkit2gtk3-lang-2.38.3-2.123.1

typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2WebExtension-4_0-2.38.3-2.123.1

webkit2gtk-4_0-injected-bundles-2.38.3-2.123.1

SUSE Linux Enterprise Software Development Kit 12 SP5

typelib-1_0-WebKit2WebExtension-4_0-2.38.3-2.123.1

webkit2gtk3-devel-2.38.3-2.123.1

SUSE OpenStack Cloud 9

libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

libwebkit2gtk-4_0-37-2.38.3-2.123.1

libwebkit2gtk3-lang-2.38.3-2.123.1

typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2WebExtension-4_0-2.38.3-2.123.1

webkit2gtk-4_0-injected-bundles-2.38.3-2.123.1

SUSE OpenStack Cloud Crowbar 9

libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

libwebkit2gtk-4_0-37-2.38.3-2.123.1

libwebkit2gtk3-lang-2.38.3-2.123.1

typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2-4_0-2.38.3-2.123.1

typelib-1_0-WebKit2WebExtension-4_0-2.38.3-2.123.1

webkit2gtk-4_0-injected-bundles-2.38.3-2.123.1

Ссылки

https://www.suse.com/support/update/announcement/2023/suse-su-20230061-1/
Link for SUSE-SU-2023:0061-1
https://lists.suse.com/pipermail/sle-security-updates/2023-January/013448.html
E-Mail link for SUSE-SU-2023:0061-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1206474
SUSE Bug 1206474
https://bugzilla.suse.com/1206750
SUSE Bug 1206750
https://www.suse.com/security/cve/CVE-2022-42852/
SUSE CVE CVE-2022-42852 page
https://www.suse.com/security/cve/CVE-2022-42856/
SUSE CVE CVE-2022-42856 page
https://www.suse.com/security/cve/CVE-2022-42863/
SUSE CVE CVE-2022-42863 page
https://www.suse.com/security/cve/CVE-2022-42867/
SUSE CVE CVE-2022-42867 page
https://www.suse.com/security/cve/CVE-2022-46691/
SUSE CVE CVE-2022-46691 page
https://www.suse.com/security/cve/CVE-2022-46692/
SUSE CVE CVE-2022-46692 page
https://www.suse.com/security/cve/CVE-2022-46698/
SUSE CVE CVE-2022-46698 page
https://www.suse.com/security/cve/CVE-2022-46699/
SUSE CVE CVE-2022-46699 page
https://www.suse.com/security/cve/CVE-2022-46700/
SUSE CVE CVE-2022-46700 page

Описание

The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory.

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-42852.html
CVE-2022-42852

Описание

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-42856.html
CVE-2022-42856
https://bugzilla.suse.com/1206474
SUSE Bug 1206474

Описание

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-42863.html
CVE-2022-42863

Описание

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-42867.html
CVE-2022-42867

Описание

A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-46691.html
CVE-2022-46691

Описание

A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy.

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-46692.html
CVE-2022-46692

Описание

A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information.

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-46698.html
CVE-2022-46698

Описание

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-46699.html
CVE-2022-46699

Описание

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.

Затронутые продукты

SUSE Linux Enterprise Server 12 SP2-BCL:libjavascriptcoregtk-4_0-18-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk-4_0-37-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:libwebkit2gtk3-lang-2.38.3-2.123.1

SUSE Linux Enterprise Server 12 SP2-BCL:typelib-1_0-JavaScriptCore-4_0-2.38.3-2.123.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-46700.html
CVE-2022-46700

SUSE-SU-2023:0061-1

Описание

Список пакетов

SUSE Linux Enterprise Server 12 SP2-BCL

SUSE Linux Enterprise Server 12 SP4-LTSS

SUSE Linux Enterprise Server 12 SP5

SUSE Linux Enterprise Server for SAP Applications 12 SP4

SUSE Linux Enterprise Server for SAP Applications 12 SP5

SUSE Linux Enterprise Software Development Kit 12 SP5

SUSE OpenStack Cloud 9

SUSE OpenStack Cloud Crowbar 9

Ссылки

Уязвимость: CVE-2022-42852

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-42856

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-42863

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-42867

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-46691

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-46692

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-46698

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-46699

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-46700

Описание

Затронутые продукты

Ссылки