Headline
Red Hat Security Advisory 2022-6634-01
Red Hat Security Advisory 2022-6634-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include a code execution vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: webkit2gtk3 security update
Advisory ID: RHSA-2022:6634-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6634
Issue date: 2022-09-20
CVE Names: CVE-2022-32893
=====================================================================
- Summary:
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64
- Description:
WebKitGTK is the port of the portable web rendering engine WebKit to the
GTK platform.
The following packages have been upgraded to a later upstream version:
webkit2gtk3 (2.36.7).
Security Fix(es):
- webkitgtk: processing maliciously crafted web content may lead to
arbitrary code execution (CVE-2022-32893)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2121645 - CVE-2022-32893 webkitgtk: processing maliciously crafted web content may lead to arbitrary code execution
- Package List:
Red Hat Enterprise Linux AppStream (v. 9):
Source:
webkit2gtk3-2.36.7-1.el9_0.src.rpm
aarch64:
webkit2gtk3-2.36.7-1.el9_0.aarch64.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_0.aarch64.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_0.aarch64.rpm
webkit2gtk3-devel-2.36.7-1.el9_0.aarch64.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_0.aarch64.rpm
webkit2gtk3-jsc-2.36.7-1.el9_0.aarch64.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_0.aarch64.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_0.aarch64.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_0.aarch64.rpm
ppc64le:
webkit2gtk3-2.36.7-1.el9_0.ppc64le.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_0.ppc64le.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_0.ppc64le.rpm
webkit2gtk3-devel-2.36.7-1.el9_0.ppc64le.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_0.ppc64le.rpm
webkit2gtk3-jsc-2.36.7-1.el9_0.ppc64le.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_0.ppc64le.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_0.ppc64le.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_0.ppc64le.rpm
s390x:
webkit2gtk3-2.36.7-1.el9_0.s390x.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_0.s390x.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_0.s390x.rpm
webkit2gtk3-devel-2.36.7-1.el9_0.s390x.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_0.s390x.rpm
webkit2gtk3-jsc-2.36.7-1.el9_0.s390x.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_0.s390x.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_0.s390x.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_0.s390x.rpm
x86_64:
webkit2gtk3-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-2.36.7-1.el9_0.x86_64.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_0.x86_64.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_0.x86_64.rpm
webkit2gtk3-devel-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-devel-2.36.7-1.el9_0.x86_64.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_0.x86_64.rpm
webkit2gtk3-jsc-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-jsc-2.36.7-1.el9_0.x86_64.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_0.x86_64.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_0.x86_64.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_0.i686.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-32893
https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYypfctzjgjWX9erEAQjA2g//RRYnsrJwmLSw/YoPS09EbxgsAaJ1RtRo
qkrYvpnvgUUcR8R9DBzn7BLmPq2t/2sQBO7xI5i0Kl1c1EszV3+Zy8gLhNWc0A0+
KPdWKbrE2pEd7SCI171Jmphq62q6leogd53Wj0KHaVIjjxO6pnoQqwlKWAELpk0f
6jd9TQqvdiynZuHTELTj2AlkqYDP/Lola+hsNAfAm0klKs+QMPujtqP02t8pd4NA
NL0Jn4EjSXQHKp/2xDIw04SX+ZaBhONmnxe9BP+oD7xrdO1MiENph+SRrIH0kIGV
kE2aOvOymNe2g1VIW3a3flbt73XP7/wBi6fY61vh8wu3vrIgarUFDsVTuXUbqON6
REw36NZP67ypl83h7odbLVPa0BQ7LHb1ALlZqQ0q717tbeTu/vzRhpyqzlEdJ3/v
tpqzLbwYpmWM9l5a7WRAgEGBk/5n/wSP0hSWvM16nT/E+F4gmf6DsaTMVdhlxbRI
Y+pSNtUHMRm7d3CA/VsfS7cAyLMiqrLE7StwSj0DkPT/Tz4LCUXy5TkCy4rTB7Bg
cwNdK2d/JB0zpKmi1K1YguA5dYAClxMF4SEy2EwwlbL62wZUzsyMuOOyXq9aStlE
ILicD7q9fjhDKEAodB5y2/XoB6xUpbszrT7dOjvwMs9FrthdNLeOvB91/aCt/tcF
wRVOZr938yc=
=OoQv
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Apple on Tuesday rolled out security updates to iOS, iPadOS, macOS, tvOS, and Safari web browser to address a new zero-day vulnerability that could result in the execution of malicious code. Tracked as CVE-2022-42856, the issue has been described by the tech giant as a type confusion issue in the WebKit browser engine that could be triggered when processing specially crafted content, leading to
Apple Security Advisory 2022-10-27-13 - watchOS 9 addresses buffer overflow, bypass, code execution, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities.
Such exploits sell for up to $10 million, making them the single most valuable commodity in the cybercrime underworld.
Red Hat Security Advisory 2022-6540-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include a code execution vulnerability.
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-32893: webkitgtk: processing maliciously crafted web content may lead to arbitrary code execution
Ubuntu Security Notice 5611-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
Categories: News Tags: Apple Tags: iOS 12.5.6 Tags: webkit Tags: CVE-2022-32893 Apple has released a security update for iOS 12.5.6 to patch a remotely exploitable WebKit vulnerability that allows attackers to execute arbitrary code on unpatched devices. (Read more...) The post Apple releases security update for iPhones and iPads to address vulnerability appeared first on Malwarebytes Labs.
Gentoo Linux Security Advisory 202208-39 - Multiple vulnerabilities have been found in WebkitGTK+, the worst of which could result in the arbitrary execution of code. Versions less than 2.36.7 are affected.
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Russia’s invasion of Ukraine was once the most talked about story in the world. Six months into the conflict, modern attention spans have moved on to other news stories. But Ukraine Independence Day yesterday should serve as a reminder to everyone that the threats to Ukraine have not gone anywhere. The country still faces a physical conflict with Russia every day that seemingly has no easy end, and the barrage of cyber attacks is suspected to continue. As discussed in our livestream yesterday, Talos continues to see evolving cybersecurity threats in the region, including the most recent GoMet backdoor. And as Joe Marshall highlighted in his blog post last week, Ukraine’s agriculture industry — which is vital to the global food supply chain — remains vulnerable to kinetic and virtual attacks. Because there’s been no one major cyber attack against Ukraine since Russia’s invasion began, the larg...
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Categories: Exploits and vulnerabilities Categories: News CISA updated its catalog of actively exploited vulnerabilities. Make sure you update your software before the due date! (Read more...) The post CISA wants you to patch these actively exploited vulnerabilities before September 8 appeared first on Malwarebytes Labs.
The fact that the flaws enable remote code execution, exist across all major Apple OS technologies, and are being actively exploited heightens the need for a quick response.
Apple Security Advisory 2022-08-18-1 - Safari 15.6.1 addresses code execution and out of bounds write vulnerabilities.
Apple on Wednesday released security updates for iOS, iPadOS, and macOS platforms to remediate two zero-day vulnerabilities previously exploited by threat actors to compromise its devices. The list of issues is below - CVE-2022-32893 - An out-of-bounds issue in WebKit which could lead to the execution of arbitrary code by processing a specially crafted web content CVE-2022-32894 - An