Gentoo alert 202407-13 (WebKitGTK+)
| From: | glsamaker@gentoo.org | |
| To: | gentoo-announce@lists.gentoo.org | |
| Subject: | [gentoo-announce] [ GLSA 202407-13 ] WebKitGTK+: Multiple Vulnerabilities | |
| Date: | Fri, 05 Jul 2024 07:35:05 -0000 | |
| Message-ID: | <172016490622.7.3219607309130570068@3f85d36892cf> |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202407-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: WebKitGTK+: Multiple Vulnerabilities Date: July 05, 2024 Bugs: #923851, #930116 ID: 202407-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in WebKitGTK+, the worst of which could lead to arbitrary code execution Background ========== WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Affected packages ================= Package Vulnerable Unaffected ------------------- ------------ ------------- net-libs/webkit-gtk < 2.44.0:4 >= 2.44.0:4 < 2.44.0:4.1 >= 2.44.0:4.1 < 2.44.0:6 >= 2.44.0:6 Description =========== Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All WebKitGTK+ users should upgrade to the latest version (depending on the installed slots): # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.44.0:4" # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.44.0:4.1" # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.44.0:6" References ========== [ 1 ] CVE-2014-1745 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1745 [ 2 ] CVE-2023-40414 https://nvd.nist.gov/vuln/detail/CVE-2023-40414 [ 3 ] CVE-2023-42833 https://nvd.nist.gov/vuln/detail/CVE-2023-42833 [ 4 ] CVE-2023-42843 https://nvd.nist.gov/vuln/detail/CVE-2023-42843 [ 5 ] CVE-2023-42950 https://nvd.nist.gov/vuln/detail/CVE-2023-42950 [ 6 ] CVE-2023-42956 https://nvd.nist.gov/vuln/detail/CVE-2023-42956 [ 7 ] CVE-2024-23206 https://nvd.nist.gov/vuln/detail/CVE-2024-23206 [ 8 ] CVE-2024-23213 https://nvd.nist.gov/vuln/detail/CVE-2024-23213 [ 9 ] CVE-2024-23222 https://nvd.nist.gov/vuln/detail/CVE-2024-23222 [ 10 ] CVE-2024-23252 https://nvd.nist.gov/vuln/detail/CVE-2024-23252 [ 11 ] CVE-2024-23254 https://nvd.nist.gov/vuln/detail/CVE-2024-23254 [ 12 ] CVE-2024-23263 https://nvd.nist.gov/vuln/detail/CVE-2024-23263 [ 13 ] CVE-2024-23280 https://nvd.nist.gov/vuln/detail/CVE-2024-23280 [ 14 ] CVE-2024-23284 https://nvd.nist.gov/vuln/detail/CVE-2024-23284 [ 15 ] WSA-2024-0001 https://webkitgtk.org/security/WSA-2024-0001.html [ 16 ] WSA-2024-0002 https://webkitgtk.org/security/WSA-2024-0002.html Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202407-13 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmaHoikACgkQFMQkOaVy +9nySg/8C2l4Dmc9eM4jc3ZgBhIC4taaNpHQ5jX6lrq4CDgarOFFzEBaWtKVGOiG Zpie9rmxO/+MxC2ccnnllwh5XZNfb+ZCgUbm62xIvT2HmBk4lxz5SBMTgDebbHIR CJ28rHAEwvyPIi5lbkpCalAynSOZAH3ZjoiElkmI+FGxE2+7PiK/fRR9eHecwhx5 LIYRFTtJiqBySGN1oQ8dDoi/PFKK9pQP7rGxw0wuRtH6PH5cr3ZS3RF2aIrbHuiS +UwGH21JvsDKaknpC3x+rBG1JkwOhJRcw4a2O61NuqHwcJPU+4fBEN1or9MVlxo3 TxpGwfha7Im+EHz+2nb330Umck46fQ3a13ouynHAV4aursmTP9O2RS9L2f3WC85E JpEQ/9XjhUD7zXOkPkjVUgIjPlK+OiAmVV3jmtM7VHuHUlOZiPLajEvjoJf8e7Af zMzB51eh6WjydEp2C1ynfkXZCYUr/iXvVZLPWXkbxuWizlHJ/8HZtygxTKNg90OA 4YiSO3dHiXrFoSTNn+tDPgvvq4mEFNXh3OZ7TbdVGapvg+KUobOaafDPRhLyUzPn FdY6wPwH7T91g3xaVFPRWqGvXDKNnAJtyLE/4RJmG8vEI6O6U4SQgUekKlJOR9Tv 52kVTxpIuUyN+GjxbuFCXQwqZ287oiVeVAxp1Kx2llhs8QygOi4= =N5Dz -----END PGP SIGNATURE-----