AlmaLinux alert ALSA-2024:9636 (webkit2gtk3)

From:
             
 
AlmaLinux Errata Notifications <errata@almalinux.org>
To:
             
 
announce@lists.almalinux.org
Subject:
             
 
[Announce]  [Security Advisory] ALSA-2024:9636: webkit2gtk3 security update (Important)
Date:
             
 
Fri, 15 Nov 2024 06:00:04 -0800
Message-ID:
             
 
<673753e4.c80a0220.21fb7e.7230@mx.google.com>
Archive-link:
             
 
Article
Hi,

You are receiving an AlmaLinux Security update email because you subscribed to receive errata
notifications from AlmaLinux.

AlmaLinux: 8
Type: Security
Severity: Important
Release date: 2024-11-15

Summary:

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.  

Security Fix(es):  

  * chromium-browser: Use after free in ANGLE (CVE-2024-4558)
  * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected
process crash (CVE-2024-40789)
  * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking
(CVE-2024-40780)
  * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking
(CVE-2024-40779)
  * webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management
(CVE-2024-40782)
  * webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)
  * webkitgtk: A malicious website may cause unexpected cross-origin behavior (CVE-2024-23271)
  * webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-27820)
  * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-27838)
  * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
(CVE-2024-27851)
  * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)
  * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected
process crash (CVE-2024-44185)
  * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected
process crash (CVE-2024-44244)
  * webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security
Policy from being enforced (CVE-2024-44296)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments,
and other related information, refer to the CVE page(s) listed in the References section.


Full details, updated packages, references, and other related information:
https://errata.almalinux.org/8/ALSA-2024-9636.html

This message is automatically generated, please don’t reply. For further questions, please, contact
us via the AlmaLinux community chat: https://chat.almalinux.org/.
Want to change your notification settings? Sign in and manage mailing lists on
https://lists.almalinux.org.

Kind regards,
AlmaLinux Team
_______________________________________________
Announce mailing list -- announce@lists.almalinux.org
To unsubscribe send an email to announce-leave@lists.almalinux.org