Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2020:2310-1

Опубликовано: 21 дек. 2020
Источник: suse-cvrf

Описание

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues:

-webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451):

  • CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution.
  • CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution.
  • CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution.
  • CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution.
  • CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution.
  • Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531).
  • Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Список пакетов

openSUSE Leap 15.2
libjavascriptcoregtk-4_0-18-2.30.3-lp152.2.7.3
libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp152.2.7.3
libwebkit2gtk-4_0-37-2.30.3-lp152.2.7.3
libwebkit2gtk-4_0-37-32bit-2.30.3-lp152.2.7.3
libwebkit2gtk3-lang-2.30.3-lp152.2.7.3
typelib-1_0-JavaScriptCore-4_0-2.30.3-lp152.2.7.3
typelib-1_0-WebKit2-4_0-2.30.3-lp152.2.7.3
typelib-1_0-WebKit2WebExtension-4_0-2.30.3-lp152.2.7.3
webkit-jsc-4-2.30.3-lp152.2.7.3
webkit2gtk-4_0-injected-bundles-2.30.3-lp152.2.7.3
webkit2gtk3-devel-2.30.3-lp152.2.7.3
webkit2gtk3-minibrowser-2.30.3-lp152.2.7.3

Ссылки

Описание

A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

Затронутые продукты
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-32bit-2.30.3-lp152.2.7.3
Ссылки

Описание

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.

Затронутые продукты
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-32bit-2.30.3-lp152.2.7.3
Ссылки

Описание

A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.

Затронутые продукты
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-32bit-2.30.3-lp152.2.7.3
Ссылки

Описание

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.

Затронутые продукты
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-32bit-2.30.3-lp152.2.7.3
Ссылки

Описание

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to code execution.

Затронутые продукты
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libjavascriptcoregtk-4_0-18-32bit-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-2.30.3-lp152.2.7.3
openSUSE Leap 15.2:libwebkit2gtk-4_0-37-32bit-2.30.3-lp152.2.7.3
Ссылки
Уязвимость openSUSE-SU-2020:2310-1