Description:
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.34.6). (BZ#1985042)
Security Fix(es):
* webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free (CVE-2022-22620)
* webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)
* webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)
* webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)
* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)
* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)
* webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)
* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)
* webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)
* webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)
* webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)
* webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)
* webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30934)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30936)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30951)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30952)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30953)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30954)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30984)
* webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create (CVE-2021-45481)
* webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)
* webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)
* webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript (CVE-2022-22589)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-22590)
* webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2022-22592)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)
* webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)
* webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)
* webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Updated packages listed below:
Architecture |
Package |
Checksum |
aarch64 |
webkit2gtk3-jsc-2.34.6-1.el8.aarch64.rpm |
5accaff5cefbcd495a893b7a6fa5fe617f6a739a721389794d11466113ba1aff |
aarch64 |
webkit2gtk3-2.34.6-1.el8.aarch64.rpm |
d4bd5f406e588601e1b4fc94c69c209fb46eb1f27a5c4d8fc7f36979f5fbdd8e |
aarch64 |
webkit2gtk3-devel-2.34.6-1.el8.aarch64.rpm |
f75a33fd43c89ea65d0ace6ede5621c0313cf6cf864acdc0aedc4996c121fa78 |
aarch64 |
webkit2gtk3-jsc-devel-2.34.6-1.el8.aarch64.rpm |
fc176a5eda1bb51ffedba3b88059b9339dce0bdcbd82508f284f069695c819fb |
ppc64le |
webkit2gtk3-jsc-2.34.6-1.el8.ppc64le.rpm |
050b59cedc1bc31d52fb9e473e6b77f2a1fa791d1239e6616462e29c3f5ae353 |
ppc64le |
webkit2gtk3-jsc-devel-2.34.6-1.el8.ppc64le.rpm |
265c0f8897010eda5c69723edb3961ac030e9f4a0ddee5cfea63227e5897cf55 |
ppc64le |
webkit2gtk3-2.34.6-1.el8.ppc64le.rpm |
5a48b70d474bf89f9dcfad7153a0397b530631e15e2f951410729ed699cc0246 |
ppc64le |
webkit2gtk3-devel-2.34.6-1.el8.ppc64le.rpm |
bd546790b6d96b384e0f72a81a6f003157e1052c449c5bf875db2023140cbb32 |
x86_64 |
webkit2gtk3-2.34.6-1.el8.x86_64.rpm |
17cf5cbfd173b38c9c39566b07c831aabbe0f34a262caed25d1a3d6c2ff19f02 |
x86_64 |
webkit2gtk3-jsc-devel-2.34.6-1.el8.x86_64.rpm |
6f6c4ad8668830e7bb8bae1e3bb60656a4532081f43b64ec925ccc2ee4dbf70a |
x86_64 |
webkit2gtk3-jsc-2.34.6-1.el8.x86_64.rpm |
78ab3ea8e8e57f5331d6abf15d0e8b2a75b7a036ed99ecf49982478dcbaca554 |
x86_64 |
webkit2gtk3-devel-2.34.6-1.el8.x86_64.rpm |
90daf1f353ae8a822228296f706f80a782840b9440e29e252761258fff916dd3 |