Red Hat Product Errata RHSA-2024:9144 - Security Advisory
Issued:
2024-11-12
Updated:
2024-11-12

RHSA-2024:9144 - Security Advisory

Synopsis

Important: webkit2gtk3 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • webkit: visiting a malicious website may lead to address bar spoofing (CVE-2023-42843)
  • webkit: heap use-after-free may lead to arbitrary code execution (CVE-2023-42950)
  • webkit: processing malicious web content may lead to a denial of service (CVE-2023-42956)
  • chromium-browser: Use after free in ANGLE (CVE-2024-4558)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2271717 - CVE-2023-42843 webkit: visiting a malicious website may lead to address bar spoofing
  • BZ - 2271718 - CVE-2023-42950 webkit: heap use-after-free may lead to arbitrary code execution
  • BZ - 2271719 - CVE-2023-42956 webkit: processing malicious web content may lead to a denial of service
  • BZ - 2279689 - CVE-2024-4558 chromium-browser: Use after free in ANGLE
  • RHEL-32578 - Upgrade WebKitGTK for RHEL 9.5

Red Hat Enterprise Linux for x86_64 9

SRPM
webkit2gtk3-2.44.3-2.el9.src.rpm SHA-256: ab52c03ec9786571e11846f8d581de2cc61269d226f8614a43ad7db91f7bb0d9
x86_64
webkit2gtk3-2.44.3-2.el9.i686.rpm SHA-256: 689ed9765e8aea114e0541da5a7bc58ac7867a33c396ac6e430a984c15df2bb0
webkit2gtk3-2.44.3-2.el9.x86_64.rpm SHA-256: 94716b8afd145edd1f4a1f1a317cbab16fcf8e9ed2146521d41bb0fe774e8679
webkit2gtk3-debuginfo-2.44.3-2.el9.i686.rpm SHA-256: 0974e8f58541a5e6d2c91c62f083845a67cf5909bc859e8b867a9e5c9df57a33
webkit2gtk3-debuginfo-2.44.3-2.el9.x86_64.rpm SHA-256: 2e16cb951ad92b5486fc3e6493d329002a69813e7894df3df98b4d35f3deeb9b
webkit2gtk3-debugsource-2.44.3-2.el9.i686.rpm SHA-256: 327dbee0ca98625b41c6611f3e2db2ea19498e3f048f25ccbba3c5509777a9a4
webkit2gtk3-debugsource-2.44.3-2.el9.x86_64.rpm SHA-256: 69de85615ec165f9c607ba095bcb5842994c2d76e34115a6a1939dd2a0d2409f
webkit2gtk3-devel-2.44.3-2.el9.i686.rpm SHA-256: 85e14d49ec3a8d00ff1151471f209280b3e8212e1c6c2d0e5264f89b5d8740a4
webkit2gtk3-devel-2.44.3-2.el9.x86_64.rpm SHA-256: d88d6ea0ee74aafa47d9ddc58f3c0999ac8f38f7fca9d2e5c781eaf020bade5b
webkit2gtk3-devel-debuginfo-2.44.3-2.el9.i686.rpm SHA-256: cffd38fe68aa69395b4de872bf9c942cf0022de94f4233dac72a7108638effee
webkit2gtk3-devel-debuginfo-2.44.3-2.el9.x86_64.rpm SHA-256: ab2ed1a93d1ce7e414703b4b5283a2e5be8b4c9014e995790ebe8b24f56b1198
webkit2gtk3-jsc-2.44.3-2.el9.i686.rpm SHA-256: 3a7ffc334643df6fc3d415891a03410d7242107d48267c693f4e6217cff95e66
webkit2gtk3-jsc-2.44.3-2.el9.x86_64.rpm SHA-256: f1616b5f379203f3a9f79e0d1c55f93fa221f151b9edd170108fa8bbbc793821
webkit2gtk3-jsc-debuginfo-2.44.3-2.el9.i686.rpm SHA-256: 6b5c10f8fd20c665288f19ee3d173d02b4864ec907ba22217411b3f09c0d8cd0
webkit2gtk3-jsc-debuginfo-2.44.3-2.el9.x86_64.rpm SHA-256: 0850ded728979f5ac290e390c5973777fcb3f90929dc4befe8010d9d370e5862
webkit2gtk3-jsc-devel-2.44.3-2.el9.i686.rpm SHA-256: 32c302c80e8679d4862c650c03a6e23034e51393f79516418e2a50d94f82074e
webkit2gtk3-jsc-devel-2.44.3-2.el9.x86_64.rpm SHA-256: cd554f94922060e00c8f17a498a7cbda1ff19ba75731afd475c448857b309f72
webkit2gtk3-jsc-devel-debuginfo-2.44.3-2.el9.i686.rpm SHA-256: 6baff66ac2ea144e7f92352a448255c0ba7f4a480a729bb44014bf9f1ba3ea83
webkit2gtk3-jsc-devel-debuginfo-2.44.3-2.el9.x86_64.rpm SHA-256: 36f12a78c27e4aa32d333f2da50fd3f501d4f7b6f03a27a7c272e81878856423

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
webkit2gtk3-2.44.3-2.el9.src.rpm SHA-256: ab52c03ec9786571e11846f8d581de2cc61269d226f8614a43ad7db91f7bb0d9
s390x
webkit2gtk3-2.44.3-2.el9.s390x.rpm SHA-256: 2fcee66b6e457096b9cb5394adc4759f096477b489ed33aca9e1d2d7ddb6c399
webkit2gtk3-debuginfo-2.44.3-2.el9.s390x.rpm SHA-256: 5afc0e5d891b88cf45eaed9db57f5a73a7f0249f8272cf6b4ce9f1660b053845
webkit2gtk3-debugsource-2.44.3-2.el9.s390x.rpm SHA-256: 200f66c6d8cdee2d3952c3271615d79f4ffdad62d23f4d93da238ad6f04c5217
webkit2gtk3-devel-2.44.3-2.el9.s390x.rpm SHA-256: 2dad666febdee52501473aceb6dabef3225358c433376780d8f788f14d3a67ab
webkit2gtk3-devel-debuginfo-2.44.3-2.el9.s390x.rpm SHA-256: c9381fe9bbdee27588578131f86146ff30951aa672d63718adbfc12a2b61fcee
webkit2gtk3-jsc-2.44.3-2.el9.s390x.rpm SHA-256: f2847f6487756a39dd973c71a01abf672e95f001273ad689fdb7ce70870928b3
webkit2gtk3-jsc-debuginfo-2.44.3-2.el9.s390x.rpm SHA-256: 35717b1b54c23057c23a89a948d0e3937293d84a0493e1a3f6f47aea127109b2
webkit2gtk3-jsc-devel-2.44.3-2.el9.s390x.rpm SHA-256: c90365d63127bc195b5550ffe0ed3e5de121f4d82498860271b14535c151dc38
webkit2gtk3-jsc-devel-debuginfo-2.44.3-2.el9.s390x.rpm SHA-256: 7f24a0b90738a75cef691793fe5dd0ad799f5a72c7650388bbc0b36a4cb9a385

Red Hat Enterprise Linux for Power, little endian 9

SRPM
webkit2gtk3-2.44.3-2.el9.src.rpm SHA-256: ab52c03ec9786571e11846f8d581de2cc61269d226f8614a43ad7db91f7bb0d9
ppc64le
webkit2gtk3-2.44.3-2.el9.ppc64le.rpm SHA-256: 0821dea457084f20a1fa0ab6f8868483a6b1cdb1f363e1c6039e86e4a0ec2816
webkit2gtk3-debuginfo-2.44.3-2.el9.ppc64le.rpm SHA-256: a7080bd7de54a3cc7bc5b761b5b3adbdd58f97b45532b30f7257b3ac07156955
webkit2gtk3-debugsource-2.44.3-2.el9.ppc64le.rpm SHA-256: c6e8ac4933b796562259c14fa5e4c86e9b0b509c873e1e58a8ce7e9e13c7543f
webkit2gtk3-devel-2.44.3-2.el9.ppc64le.rpm SHA-256: 672a0b64db8cd3568b6edc63cc9d46cc6117d83c8208623af08a6a8803265a87
webkit2gtk3-devel-debuginfo-2.44.3-2.el9.ppc64le.rpm SHA-256: 39ecd951e1a4b5fcb66a7129444baa90c88e6c2cb97ca1598035f8538f791673
webkit2gtk3-jsc-2.44.3-2.el9.ppc64le.rpm SHA-256: daf60592494dd37be10102aa9bd058967b27d7d7582f548c9bf60efd2012f11c
webkit2gtk3-jsc-debuginfo-2.44.3-2.el9.ppc64le.rpm SHA-256: 83875947f3c0f8a0ef2808faeb807f4f34463b65af1175b47a48025e43730fad
webkit2gtk3-jsc-devel-2.44.3-2.el9.ppc64le.rpm SHA-256: 8dcdf2e26fb6ef5dd77e4c12284ff92ade9a1facc14c5b18e6c588decb399a43
webkit2gtk3-jsc-devel-debuginfo-2.44.3-2.el9.ppc64le.rpm SHA-256: 3e8fc36c86d31d259085af8b5d330d0ba718d7552388d3f0270c5513dbe2da2b

Red Hat Enterprise Linux for ARM 64 9

SRPM
webkit2gtk3-2.44.3-2.el9.src.rpm SHA-256: ab52c03ec9786571e11846f8d581de2cc61269d226f8614a43ad7db91f7bb0d9
aarch64
webkit2gtk3-2.44.3-2.el9.aarch64.rpm SHA-256: bf2ceba01d9829406cc8ec4512b6d9ea9a1ca53804e14dd00a70082e66717734
webkit2gtk3-debuginfo-2.44.3-2.el9.aarch64.rpm SHA-256: 5a9908a95d762046357c32ee95c97326be139ce6cfd56724a13a7bcd711be6e6
webkit2gtk3-debugsource-2.44.3-2.el9.aarch64.rpm SHA-256: 3cf2955ee2b2cb7ba97bb44e7c1078c5aabee98d4871a29727fe71c5e8809343
webkit2gtk3-devel-2.44.3-2.el9.aarch64.rpm SHA-256: 9be2484a3c831b3b54618ee6a3f79fa90b677025a987527d5e2f29ef51f5b0cd
webkit2gtk3-devel-debuginfo-2.44.3-2.el9.aarch64.rpm SHA-256: c01ad3c39607cb658396ae9d9ff7d28d446eecdad2dfab285263719b052a39c8
webkit2gtk3-jsc-2.44.3-2.el9.aarch64.rpm SHA-256: 96062acc17f1f21103066200fdee391adb0a309ac306aa884995599519f839b5
webkit2gtk3-jsc-debuginfo-2.44.3-2.el9.aarch64.rpm SHA-256: bd047f4c3402b4f5ba4c1239659c6efc06d300920c71c8122bbe636879f63b2e
webkit2gtk3-jsc-devel-2.44.3-2.el9.aarch64.rpm SHA-256: ba96b53d87d15c3e3729b9fb618aca019d27a748e4e8c6c9634932875e269c2a
webkit2gtk3-jsc-devel-debuginfo-2.44.3-2.el9.aarch64.rpm SHA-256: 700cc06c5e1a17e5add8c7fb1215999da5ca24eabe3af9140fc96f1d302251d3

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.