Headline
Ubuntu Security Notice USN-6490-1
Ubuntu Security Notice 6490-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
==========================================================================
Ubuntu Security Notice USN-6490-1
November 20, 2023
webkit2gtk vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in WebKitGTK.
Software Description:
- webkit2gtk: Web content engine library for GTK+
Details:
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libjavascriptcoregtk-4.0-18 2.42.2-0ubuntu0.23.10.1
libjavascriptcoregtk-4.1-0 2.42.2-0ubuntu0.23.10.1
libjavascriptcoregtk-6.0-1 2.42.2-0ubuntu0.23.10.1
libwebkit2gtk-4.0-37 2.42.2-0ubuntu0.23.10.1
libwebkit2gtk-4.1-0 2.42.2-0ubuntu0.23.10.1
libwebkitgtk-6.0-4 2.42.2-0ubuntu0.23.10.1
Ubuntu 23.04:
libjavascriptcoregtk-4.0-18 2.42.2-0ubuntu0.23.04.1
libjavascriptcoregtk-4.1-0 2.42.2-0ubuntu0.23.04.1
libjavascriptcoregtk-6.0-1 2.42.2-0ubuntu0.23.04.1
libwebkit2gtk-4.0-37 2.42.2-0ubuntu0.23.04.1
libwebkit2gtk-4.1-0 2.42.2-0ubuntu0.23.04.1
libwebkitgtk-6.0-4 2.42.2-0ubuntu0.23.04.1
Ubuntu 22.04 LTS:
libjavascriptcoregtk-4.0-18 2.42.2-0ubuntu0.22.04.1
libjavascriptcoregtk-4.1-0 2.42.2-0ubuntu0.22.04.1
libjavascriptcoregtk-6.0-1 2.42.2-0ubuntu0.22.04.1
libwebkit2gtk-4.0-37 2.42.2-0ubuntu0.22.04.1
libwebkit2gtk-4.1-0 2.42.2-0ubuntu0.22.04.1
libwebkitgtk-6.0-4 2.42.2-0ubuntu0.22.04.1
libwebkitgtk-6.0-dev 2.42.2-0ubuntu0.22.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6490-1
CVE-2023-41983, CVE-2023-42852
Package Information:
https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.2-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.2-0ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.2-0ubuntu0.22.04.1
Related news
Gentoo Linux Security Advisory 202401-33 - Multiple vulnerabilities have been found in WebKitGTK+, the worst of which may lead to remote code execution. Versions greater than or equal to 2.42.2:4 are affected.
Debian Linux Security Advisory 5557-1 - WebKitGTK has vulnerabilities. Junsung Lee discovered that processing web content may lead to a denial-of-service. An anonymous researcher discovered that processing web content may lead to arbitrary code execution.
Debian Linux Security Advisory 5557-1 - WebKitGTK has vulnerabilities. Junsung Lee discovered that processing web content may lead to a denial-of-service. An anonymous researcher discovered that processing web content may lead to arbitrary code execution.
Plus: Major vulnerability fixes are now available for a number of enterprise giants, including Cisco, VMWare, Citrix, and SAP.
Categories: Exploits and vulnerabilities Categories: News Tags: iLeakage Tags: side-channel Tags: Safari Tags: CVE-2023-40413 Tags: CVE-2023-40416 Tags: CVE-2023-40423 Tags: CVE-2023-42487 Tags: CVE-2023-42841 Tags: CVE-2023-41982 Tags: CVE-2023-41997 Tags: CVE-2023-41988 Tags: CVE-2023-40447 Tags: CVE-2023-42852 Tags: CVE-2023-32434 Tags: CVE-2023-41989 Tags: CVE-2023-38403 Tags: CVE-2023-42856 Tags: CVE-2023-40404 Tags: CVE-2023-41977 Tags: Vim Apple has released security updates for its phones, iPads, Macs, watches and TVs. (Read more...) The post Update now! Apple patches a raft of vulnerabilities appeared first on Malwarebytes Labs.
Apple Security Advisory 10-25-2023-9 - Safari 17.1 addresses code execution and use-after-free vulnerabilities.
Apple Security Advisory 10-25-2023-9 - Safari 17.1 addresses code execution and use-after-free vulnerabilities.
Apple Security Advisory 10-25-2023-4 - macOS Sonoma 14.1 addresses bypass, code execution, spoofing, and use-after-free vulnerabilities.
Apple Security Advisory 10-25-2023-2 - iOS 16.7.2 and iPadOS 16.7.2 addresses bypass, code execution, and use-after-free vulnerabilities.
Apple Security Advisory 10-25-2023-2 - iOS 16.7.2 and iPadOS 16.7.2 addresses bypass, code execution, and use-after-free vulnerabilities.
Apple Security Advisory 10-25-2023-7 - tvOS 17.1 addresses code execution and use-after-free vulnerabilities.
Apple Security Advisory 10-25-2023-1 - iOS 17.1 and iPadOS 17.1 addresses bypass, code execution, and use-after-free vulnerabilities.
Apple Security Advisory 10-25-2023-1 - iOS 17.1 and iPadOS 17.1 addresses bypass, code execution, and use-after-free vulnerabilities.
A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. An attacker with knowledge of a standard user's credentials can unlock another standard user's locked screen on the same Mac.
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14.1, iOS 16.7.2 and iPadOS 16.7.2. Visiting a malicious website may reveal browsing history.
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14.1, iOS 16.7.2 and iPadOS 16.7.2. Visiting a malicious website may reveal browsing history.
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. An attacker with knowledge of a standard user's credentials can unlock another standard user's locked screen on the same Mac.