Red Hat Product Errata RHSA-2024:9636 - Security Advisory
Issued:
2024-11-14
Updated:
2024-11-14

RHSA-2024:9636 - Security Advisory

Synopsis

Important: webkit2gtk3 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • chromium-browser: Use after free in ANGLE (CVE-2024-4558)
  • webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-40789)
  • webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40780)
  • webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40779)
  • webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management (CVE-2024-40782)
  • webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)
  • webkitgtk: A malicious website may cause unexpected cross-origin behavior (CVE-2024-23271)
  • webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-27820)
  • webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-27838)
  • webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2024-27851)
  • webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)
  • webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44185)
  • webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44244)
  • webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2024-44296)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 2279689 - CVE-2024-4558 chromium-browser: Use after free in ANGLE
  • BZ - 2302067 - CVE-2024-40789 webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2302069 - CVE-2024-40780 webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking
  • BZ - 2302070 - CVE-2024-40779 webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking
  • BZ - 2302071 - CVE-2024-40782 webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management
  • BZ - 2312724 - CVE-2024-40866 webkitgtk: Visiting a malicious website may lead to address bar spoofing
  • BZ - 2314696 - CVE-2024-23271 webkitgtk: A malicious website may cause unexpected cross-origin behavior
  • BZ - 2314698 - CVE-2024-27820 webkitgtk: Processing web content may lead to arbitrary code execution
  • BZ - 2314702 - CVE-2024-27838 webkitgtk: A maliciously crafted webpage may be able to fingerprint the user
  • BZ - 2314704 - CVE-2024-27851 webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
  • BZ - 2314706 - CVE-2024-44187 webkitgtk: A malicious website may exfiltrate data cross-origin
  • BZ - 2323263 - CVE-2024-44185 webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2323278 - CVE-2024-44244 webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2323289 - CVE-2024-44296 webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced

Red Hat Enterprise Linux for x86_64 8

SRPM
webkit2gtk3-2.46.3-1.el8_10.src.rpm SHA-256: b3db793efc9ba8a65d5ffd2240b3704c7f43b228fe141db02a11c1ce2b8cca14
x86_64
webkit2gtk3-2.46.3-1.el8_10.i686.rpm SHA-256: 4cfd5a9b2ee543b0589afd178d3df151ea7fc5843a69fc01cf9aba4fe83481b5
webkit2gtk3-2.46.3-1.el8_10.x86_64.rpm SHA-256: 84fe48ccad6afbd6fdd207504a4d2f5354191bd9ac45fd58124c5b571b54e07f
webkit2gtk3-debuginfo-2.46.3-1.el8_10.i686.rpm SHA-256: d69727f6717ad6fc5970ceda9151e805fec00f53d056c59df9698765eae38a07
webkit2gtk3-debuginfo-2.46.3-1.el8_10.x86_64.rpm SHA-256: 980e467d8928cae95b3a6a662fecca9202ba1d8284c95ca24ae8a9e110aea43c
webkit2gtk3-debugsource-2.46.3-1.el8_10.i686.rpm SHA-256: 1cecb8759dfe3c8a0eb7e082782b3095c803bdbe27437c3cfea1303bbdcab8c2
webkit2gtk3-debugsource-2.46.3-1.el8_10.x86_64.rpm SHA-256: bdab285fc23f4a918d17492959fb3dad1a1a8cb43b85c5ada83e84fe8b71ed96
webkit2gtk3-devel-2.46.3-1.el8_10.i686.rpm SHA-256: 4edd71b5b2a7d5f20b279a625dff9d5346edd6ad66de7ffbf1efd81f9fb8fb0d
webkit2gtk3-devel-2.46.3-1.el8_10.x86_64.rpm SHA-256: 9a285d124ec0b4c7d989e7d241c0a3444195a78435ed45f596c770afe586c684
webkit2gtk3-devel-debuginfo-2.46.3-1.el8_10.i686.rpm SHA-256: 2972de4b8e2b7ad3d615c38aa69d986125ec7e1d8e0e12039b9c5b057778a78d
webkit2gtk3-devel-debuginfo-2.46.3-1.el8_10.x86_64.rpm SHA-256: 6eabaf9de4016b493f7a07fa3901cd195229f85decadd81ffff7d90da0211e03
webkit2gtk3-jsc-2.46.3-1.el8_10.i686.rpm SHA-256: c8cf0a6b489bb678074e08c15bc997abe4f00740cbdbd321723b4e1f2fe58402
webkit2gtk3-jsc-2.46.3-1.el8_10.x86_64.rpm SHA-256: a2c1d13376585a6b8bd43f69691a5809129653955c0ae3692b7baf1c3880419b
webkit2gtk3-jsc-debuginfo-2.46.3-1.el8_10.i686.rpm SHA-256: 6d3629a07ac6d82653d41ae0acf0ee278a4dda3a321ed4feac9b20ad2801d363
webkit2gtk3-jsc-debuginfo-2.46.3-1.el8_10.x86_64.rpm SHA-256: 8dd23ab30d91565f74cf9fb6543e26cfdae1be3568cc227be95c96ca9bf5e026
webkit2gtk3-jsc-devel-2.46.3-1.el8_10.i686.rpm SHA-256: 7dea73ca7c12fdd05fa6fbf509a638dfe2224fb3c8a67ad9b22a296c2e820b82
webkit2gtk3-jsc-devel-2.46.3-1.el8_10.x86_64.rpm SHA-256: 5ce032919f684d56bdf54633b57d31ee981b17a4e9555d2119feef64eadb9b4e
webkit2gtk3-jsc-devel-debuginfo-2.46.3-1.el8_10.i686.rpm SHA-256: b6f2785edcbd17e6480b0b0e8d5386b11fed5c6308a4e183b76ef8abd9fbfe4c
webkit2gtk3-jsc-devel-debuginfo-2.46.3-1.el8_10.x86_64.rpm SHA-256: 29972cb12862fca990751411279b8640c15c18ee680184711701e11992fbe721

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
webkit2gtk3-2.46.3-1.el8_10.src.rpm SHA-256: b3db793efc9ba8a65d5ffd2240b3704c7f43b228fe141db02a11c1ce2b8cca14
s390x
webkit2gtk3-2.46.3-1.el8_10.s390x.rpm SHA-256: 73bc6c198d066252c72aee6eef378d8a5ebaf64f61e6a8f0b10845be5a975aec
webkit2gtk3-debuginfo-2.46.3-1.el8_10.s390x.rpm SHA-256: 2a285cf3ea06e090553e86becf9cb068b16962cb67319766b256626acc7e43c1
webkit2gtk3-debugsource-2.46.3-1.el8_10.s390x.rpm SHA-256: 525862d8e173972fb7264c1623100673979181fdbe1e4656c33f4bae55f5abc0
webkit2gtk3-devel-2.46.3-1.el8_10.s390x.rpm SHA-256: 06d3ccec6b9494930d72dc8625872b75ef27075fbb6fc8f5bc40ce6d51a57cf3
webkit2gtk3-devel-debuginfo-2.46.3-1.el8_10.s390x.rpm SHA-256: 082121b9b6cce86953528804c95a3bc2fa025cdfdcd3ceac62d527cee057482b
webkit2gtk3-jsc-2.46.3-1.el8_10.s390x.rpm SHA-256: 3ebc7d1dbbff61028a7fdff01d19524ee889414cfd30c4b525faf0f95bd7080e
webkit2gtk3-jsc-debuginfo-2.46.3-1.el8_10.s390x.rpm SHA-256: baad67b53dfd34d144ff7dc5a0136ac38dbd6ee155e202e52ae9490689a8eded
webkit2gtk3-jsc-devel-2.46.3-1.el8_10.s390x.rpm SHA-256: 08a86e9df205b0eb2be7b24a5bd919210670381c74c1dfd510061b58c7ca9a82
webkit2gtk3-jsc-devel-debuginfo-2.46.3-1.el8_10.s390x.rpm SHA-256: 3da6a5f1a50a837f5cba16f9715f25e9923e7d23cfa6747af145ec6f27ab4080

Red Hat Enterprise Linux for Power, little endian 8

SRPM
webkit2gtk3-2.46.3-1.el8_10.src.rpm SHA-256: b3db793efc9ba8a65d5ffd2240b3704c7f43b228fe141db02a11c1ce2b8cca14
ppc64le
webkit2gtk3-2.46.3-1.el8_10.ppc64le.rpm SHA-256: cfbd38d65c9da013e3146458bdf162c7624bd8fec52a37f3fd8d0b0435a3518d
webkit2gtk3-debuginfo-2.46.3-1.el8_10.ppc64le.rpm SHA-256: 38d915c0523e17f7ddb00e9b86194d25e795ff348e94645f7ecb615df30141df
webkit2gtk3-debugsource-2.46.3-1.el8_10.ppc64le.rpm SHA-256: 6ec8e6fa38fa89860c8434d561c553341a16937fcad9ba785e5eae510ddf21ef
webkit2gtk3-devel-2.46.3-1.el8_10.ppc64le.rpm SHA-256: ecf516254384bf749224cb936f28a2c60e1a82c662d7f5a68e1052b591729a90
webkit2gtk3-devel-debuginfo-2.46.3-1.el8_10.ppc64le.rpm SHA-256: 8ae3ba8325c37d7c82d6374adca631d6b757d73cbc5fbb2a59511b1aa88de397
webkit2gtk3-jsc-2.46.3-1.el8_10.ppc64le.rpm SHA-256: 3ebc4afef9f5bdad666973171f46a2bfacbb41bd6f90b63b27735ad450ceb96a
webkit2gtk3-jsc-debuginfo-2.46.3-1.el8_10.ppc64le.rpm SHA-256: 55e6be95036b903ddf297f9ed52e29cd35a27108650ebd75717cbd1e076723a2
webkit2gtk3-jsc-devel-2.46.3-1.el8_10.ppc64le.rpm SHA-256: 88aefcb5106a0261a8e5b7dae6a08e6f54054c96f2fc9e54a5900230719f4ad3
webkit2gtk3-jsc-devel-debuginfo-2.46.3-1.el8_10.ppc64le.rpm SHA-256: 2e1e06b52ba35073640ee889297401bf0e1a7625540f362afe25ede6ded24bec

Red Hat Enterprise Linux for ARM 64 8

SRPM
webkit2gtk3-2.46.3-1.el8_10.src.rpm SHA-256: b3db793efc9ba8a65d5ffd2240b3704c7f43b228fe141db02a11c1ce2b8cca14
aarch64
webkit2gtk3-2.46.3-1.el8_10.aarch64.rpm SHA-256: c36267e7b38b92069b9c1c0b6dc8ba78b8e9d8decd19ff84596f6854ecfdbb2e
webkit2gtk3-debuginfo-2.46.3-1.el8_10.aarch64.rpm SHA-256: 37437122c0d9c8489920e8b677c9d4c852a5934f5737f12c4807c2849d4e940c
webkit2gtk3-debugsource-2.46.3-1.el8_10.aarch64.rpm SHA-256: 55205f46883c1c90d9c212ffb70f07639d8442514859357eb22bd638794b6bf4
webkit2gtk3-devel-2.46.3-1.el8_10.aarch64.rpm SHA-256: 3a48666a81c53399d8a1b4680d8a6d8a0c567e46494c402787dfcac4d73f44d0
webkit2gtk3-devel-debuginfo-2.46.3-1.el8_10.aarch64.rpm SHA-256: 0f65866c423784346399090b622420da8291d5242161ca6f012f9610fa2a0eae
webkit2gtk3-jsc-2.46.3-1.el8_10.aarch64.rpm SHA-256: 3c4e6b2da92b8fb2e0805d3497ca39bc5bc1932cc8f57eff8d6685d528e96dad
webkit2gtk3-jsc-debuginfo-2.46.3-1.el8_10.aarch64.rpm SHA-256: 8006812990677097e141d377e919b9e98853b950d1235d991d2a13e0382256a0
webkit2gtk3-jsc-devel-2.46.3-1.el8_10.aarch64.rpm SHA-256: 48d3f7a90d29a069abfdb11d570c8937b657b0b7af928135c282d85313d44777
webkit2gtk3-jsc-devel-debuginfo-2.46.3-1.el8_10.aarch64.rpm SHA-256: 7b1895398754e78c6aeb6af5da941052c3cfe636b0176627b845c5e780d88613

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.