Headline
Ubuntu Security Notice USN-6582-1
Ubuntu Security Notice 6582-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
==========================================================================
Ubuntu Security Notice USN-6582-1
January 15, 2024
webkit2gtk vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in WebKitGTK.
Software Description:
- webkit2gtk: Web content engine library for GTK+
Details:
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libjavascriptcoregtk-4.0-18 2.42.4-0ubuntu0.23.10.1
libjavascriptcoregtk-4.1-0 2.42.4-0ubuntu0.23.10.1
libjavascriptcoregtk-6.0-1 2.42.4-0ubuntu0.23.10.1
libwebkit2gtk-4.0-37 2.42.4-0ubuntu0.23.10.1
libwebkit2gtk-4.1-0 2.42.4-0ubuntu0.23.10.1
libwebkitgtk-6.0-4 2.42.4-0ubuntu0.23.10.1
Ubuntu 23.04:
libjavascriptcoregtk-4.0-18 2.42.4-0ubuntu0.23.04.1
libjavascriptcoregtk-4.1-0 2.42.4-0ubuntu0.23.04.1
libjavascriptcoregtk-6.0-1 2.42.4-0ubuntu0.23.04.1
libwebkit2gtk-4.0-37 2.42.4-0ubuntu0.23.04.1
libwebkit2gtk-4.1-0 2.42.4-0ubuntu0.23.04.1
libwebkitgtk-6.0-4 2.42.4-0ubuntu0.23.04.1
Ubuntu 22.04 LTS:
libjavascriptcoregtk-4.0-18 2.42.4-0ubuntu0.22.04.1
libjavascriptcoregtk-4.1-0 2.42.4-0ubuntu0.22.04.1
libjavascriptcoregtk-6.0-1 2.42.4-0ubuntu0.22.04.1
libwebkit2gtk-4.0-37 2.42.4-0ubuntu0.22.04.1
libwebkit2gtk-4.1-0 2.42.4-0ubuntu0.22.04.1
libwebkitgtk-6.0-4 2.42.4-0ubuntu0.22.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6582-1
CVE-2023-42883
Package Information:
https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.4-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.4-0ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.4-0ubuntu0.22.04.1
Related news
Debian Linux Security Advisory 5580-1 - The Zoom Offensive Security Team discovered that processing a SVG image may lead to a denial-of-service.
Apple Security Advisory 12-11-2023-8 - watchOS 10.2 addresses code execution and out of bounds read vulnerabilities.
Apple Security Advisory 12-11-2023-7 - tvOS 17.2 addresses code execution and out of bounds read vulnerabilities.
Apple Security Advisory 12-11-2023-4 - macOS Sonoma 14.2 addresses code execution, out of bounds read, and spoofing vulnerabilities.
Apple Security Advisory 12-11-2023-3 - iOS 16.7.3 and iPadOS 16.7.3 addresses code execution and out of bounds read vulnerabilities.
Apple Security Advisory 12-11-2023-1 - Safari 17.2 addresses code execution vulnerabilities.
Apple on Monday released security patches for iOS, iPadOS, macOS, tvOS, watchOS, and Safari web browser to address multiple security flaws, in addition to backporting fixes for two recently disclosed zero-days to older devices. This includes updates for 12 security vulnerabilities in iOS and iPadOS spanning AVEVideoEncoder, ExtensionKit, Find My, ImageIO, Kernel, Safari
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2. An app may be able to access sensitive user data.
Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing web content may lead to arbitrary code execution.