Security
Headlines
HeadlinesLatestCVEs

Headline

Red Hat Security Advisory 2022-6540-01

Red Hat Security Advisory 2022-6540-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include a code execution vulnerability.

Packet Storm
Open in Source
#vulnerability#web#linux#red_hat#js#webkit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: webkit2gtk3 security update
Advisory ID: RHSA-2022:6540-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6540
Issue date: 2022-09-15
CVE Names: CVE-2022-32893
====================================================================

  1. Summary:

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

  1. Description:

WebKitGTK is the port of the portable web rendering engine WebKit to the
GTK platform.

The following packages have been upgraded to a later upstream version:
webkit2gtk3 (2.36.7).

Security Fix(es):

  • webkitgtk: processing maliciously crafted web content may lead to
    arbitrary code execution (CVE-2022-32893)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

2121645 - CVE-2022-32893 webkitgtk: processing maliciously crafted web content may lead to arbitrary code execution

  1. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
webkit2gtk3-2.36.7-1.el8_6.src.rpm

aarch64:
webkit2gtk3-2.36.7-1.el8_6.aarch64.rpm
webkit2gtk3-debuginfo-2.36.7-1.el8_6.aarch64.rpm
webkit2gtk3-debugsource-2.36.7-1.el8_6.aarch64.rpm
webkit2gtk3-devel-2.36.7-1.el8_6.aarch64.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el8_6.aarch64.rpm
webkit2gtk3-jsc-2.36.7-1.el8_6.aarch64.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el8_6.aarch64.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el8_6.aarch64.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el8_6.aarch64.rpm

ppc64le:
webkit2gtk3-2.36.7-1.el8_6.ppc64le.rpm
webkit2gtk3-debuginfo-2.36.7-1.el8_6.ppc64le.rpm
webkit2gtk3-debugsource-2.36.7-1.el8_6.ppc64le.rpm
webkit2gtk3-devel-2.36.7-1.el8_6.ppc64le.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el8_6.ppc64le.rpm
webkit2gtk3-jsc-2.36.7-1.el8_6.ppc64le.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el8_6.ppc64le.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el8_6.ppc64le.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el8_6.ppc64le.rpm

s390x:
webkit2gtk3-2.36.7-1.el8_6.s390x.rpm
webkit2gtk3-debuginfo-2.36.7-1.el8_6.s390x.rpm
webkit2gtk3-debugsource-2.36.7-1.el8_6.s390x.rpm
webkit2gtk3-devel-2.36.7-1.el8_6.s390x.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el8_6.s390x.rpm
webkit2gtk3-jsc-2.36.7-1.el8_6.s390x.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el8_6.s390x.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el8_6.s390x.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el8_6.s390x.rpm

x86_64:
webkit2gtk3-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-2.36.7-1.el8_6.x86_64.rpm
webkit2gtk3-debuginfo-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-debuginfo-2.36.7-1.el8_6.x86_64.rpm
webkit2gtk3-debugsource-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-debugsource-2.36.7-1.el8_6.x86_64.rpm
webkit2gtk3-devel-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-devel-2.36.7-1.el8_6.x86_64.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el8_6.x86_64.rpm
webkit2gtk3-jsc-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-jsc-2.36.7-1.el8_6.x86_64.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el8_6.x86_64.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el8_6.x86_64.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el8_6.i686.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el8_6.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2022-32893
https://access.redhat.com/security/updates/classification/#moderate

  1. Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYyMk0dzjgjWX9erEAQgJiw/+LYAkLQ3B+egDz2T8gBO2HzEtHgA8L7TO
aFWvgGSnt32NlsOLFg1R3FxvGRVurR5Vgx2QN4tvVi/iYIgGw1WTSCC2GaiamjoP
AawahjPf08LboH3d96QHN7rumXeXLUcymQyG4p4BPnEOqYPaKKdmj5CPaGWM/o+l
ECo8POkVp0mHb4HOCL8iudG5aKDmEB5OqHfQS0XmFU3392yazpD6Y1DwpIfCNAhb
ptdcqHrycH+QFUdd3YmtQj567R5+q/DAKFN60KHdwT+JeiRwdV9k89cAoWIJA6Hh
3ZxRuVbc108rySf/9tdZSjl7nw4IbLwcbScUwUHfHzjFfS3h7u+kkDLL10c4sfWf
psc1mGVUXzLN6qBaWiY96bXOUOzX72LkC0LqhgDOfjBvaGzJjFwfydDgql/TPkSZ
478+0r5JD6sFsboLugtqhXMLNpJtxYGBSMUA31Bjmf8jWGwKrzZCbxUMuQIHk7VG
4M9gdZbu5wQw6fhksOlHGowoXEvc6UTB36eSLvZ76OK65yoXmpOXTFjIFfmDACkV
M4GVQGpNglQWn/4jBXjebEeFC86baScn97NpCL41FK9AXlP7xBPaCN++DjAYDlbg
NJf8tizErS4zMa1moMYL2DEac/nhLJDwtKaCvftcdRPrVnQZEZto7Chvf1FgNAJc
+nurAiBV/zc=W4oO
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Apple Security Advisory 2022-10-27-13

Apple Security Advisory 2022-10-27-13 - watchOS 9 addresses buffer overflow, bypass, code execution, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities.

Apple's Constant Battles Against Zero-Day Exploits

Such exploits sell for up to $10 million, making them the single most valuable commodity in the cybercrime underworld.

Red Hat Security Advisory 2022-6634-01

Red Hat Security Advisory 2022-6634-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include a code execution vulnerability.

RHSA-2022:6540: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-32893: webkitgtk: processing maliciously crafted web content may lead to arbitrary code execution

Apple Releases iOS and macOS Updates to Patch Actively Exploited Zero-Day Flaw

Apple has released another round of security updates to address multiple vulnerabilities in iOS and macOS, including a new zero-day flaw that has been used in attacks in the wild. The issue, assigned the identifier CVE-2022-32917, is rooted in the Kernel component and could enable a malicious app to execute arbitrary code with kernel privileges. "Apple is aware of a report that this issue may

Apple releases security update for iPhones and iPads to address vulnerability

Categories: News Tags: Apple Tags: iOS 12.5.6 Tags: webkit Tags: CVE-2022-32893 Apple has released a security update for iOS 12.5.6 to patch a remotely exploitable WebKit vulnerability that allows attackers to execute arbitrary code on unpatched devices. (Read more...) The post Apple releases security update for iPhones and iPads to address vulnerability appeared first on Malwarebytes Labs.

Apple Security Advisory 2022-08-31-1

Apple Security Advisory 2022-08-31-1 - iOS 12.5.6 addresses code execution and out of bounds write vulnerabilities.

Gentoo Linux Security Advisory 202208-39

Gentoo Linux Security Advisory 202208-39 - Multiple vulnerabilities have been found in WebkitGTK+, the worst of which could result in the arbitrary execution of code. Versions less than 2.36.7 are affected.

Threat Source newsletter (Aug. 25, 2022) — Why aren't Lockdown modes the default setting on phones?

By Jon Munshaw.  Welcome to this week’s edition of the Threat Source newsletter.  Russia’s invasion of Ukraine was once the most talked about story in the world. Six months into the conflict, modern attention spans have moved on to other news stories. But Ukraine Independence Day yesterday should serve as a reminder to everyone that the threats to Ukraine have not gone anywhere.  The country still faces a physical conflict with Russia every day that seemingly has no easy end, and the barrage of cyber attacks is suspected to continue.   As discussed in our livestream yesterday, Talos continues to see evolving cybersecurity threats in the region, including the most recent GoMet backdoor. And as Joe Marshall highlighted in his blog post last week, Ukraine’s agriculture industry — which is vital to the global food supply chain — remains vulnerable to kinetic and virtual attacks. Because there’s been no one major cyber attack against Ukraine since Russia’s invasion began, the larg...

CISA wants you to patch these actively exploited vulnerabilities before September 8

Categories: Exploits and vulnerabilities Categories: News CISA updated its catalog of actively exploited vulnerabilities. Make sure you update your software before the due date! (Read more...) The post CISA wants you to patch these actively exploited vulnerabilities before September 8 appeared first on Malwarebytes Labs.

Patch Now: 2 Apple Zero-Days Exploited in Wild

The fact that the flaws enable remote code execution, exist across all major Apple OS technologies, and are being actively exploited heightens the need for a quick response.

iPhone Users Urged to Update to Patch 2 Zero-Days

Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack.

Urgent update for macOS and iOS! Two actively exploited zero-days fixed

Categories: Exploits and vulnerabilities Categories: News Tags: macOS Tags: iOS Tags: CVE-2022-32894 Tags: CVE-2022-32893 Tags: kernel privileges Tags: WebKit Tags: actively exploited Tags: watering hole Tags: exploit kit Apple has released emergency security updates to fix two zero-day vulnerabilities previously exploited by attackers to hack iPhones, iPads, or Macs. (Read more...) The post Urgent update for macOS and iOS! Two actively exploited zero-days fixed appeared first on Malwarebytes Labs.

Apple Releases Security Updates to Patch Two New Zero-Day Vulnerabilities

Apple on Wednesday released security updates for iOS, iPadOS, and macOS platforms to remediate two zero-day vulnerabilities previously exploited by threat actors to compromise its devices. The list of issues is below - CVE-2022-32893 - An out-of-bounds issue in WebKit which could lead to the execution of arbitrary code by processing a specially crafted web content CVE-2022-32894 - An

Packet Storm: Latest News

Acronis Cyber Protect/Backup Remote Code Execution
Packet Storm