Headline
Red Hat Security Advisory 2023-0903-01
Red Hat Security Advisory 2023-0903-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include a code execution vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: webkit2gtk3 security update
Advisory ID: RHSA-2023:0903-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0903
Issue date: 2023-02-22
CVE Names: CVE-2023-23529
====================================================================
- Summary:
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64
- Description:
WebKitGTK is the port of the portable web rendering engine WebKit to the
GTK platform.
Security Fix(es):
- webkitgtk: processing maliciously crafted web content may be exploited
for arbitrary code execution (CVE-2023-23529)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2169934 - CVE-2023-23529 webkitgtk: processing maliciously crafted web content may be exploited for arbitrary code execution
- Package List:
Red Hat Enterprise Linux AppStream (v. 9):
Source:
webkit2gtk3-2.36.7-1.el9_1.2.src.rpm
aarch64:
webkit2gtk3-2.36.7-1.el9_1.2.aarch64.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_1.2.aarch64.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_1.2.aarch64.rpm
webkit2gtk3-devel-2.36.7-1.el9_1.2.aarch64.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_1.2.aarch64.rpm
webkit2gtk3-jsc-2.36.7-1.el9_1.2.aarch64.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_1.2.aarch64.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_1.2.aarch64.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_1.2.aarch64.rpm
ppc64le:
webkit2gtk3-2.36.7-1.el9_1.2.ppc64le.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_1.2.ppc64le.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_1.2.ppc64le.rpm
webkit2gtk3-devel-2.36.7-1.el9_1.2.ppc64le.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_1.2.ppc64le.rpm
webkit2gtk3-jsc-2.36.7-1.el9_1.2.ppc64le.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_1.2.ppc64le.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_1.2.ppc64le.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_1.2.ppc64le.rpm
s390x:
webkit2gtk3-2.36.7-1.el9_1.2.s390x.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_1.2.s390x.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_1.2.s390x.rpm
webkit2gtk3-devel-2.36.7-1.el9_1.2.s390x.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_1.2.s390x.rpm
webkit2gtk3-jsc-2.36.7-1.el9_1.2.s390x.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_1.2.s390x.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_1.2.s390x.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_1.2.s390x.rpm
x86_64:
webkit2gtk3-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-2.36.7-1.el9_1.2.x86_64.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-debuginfo-2.36.7-1.el9_1.2.x86_64.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-debugsource-2.36.7-1.el9_1.2.x86_64.rpm
webkit2gtk3-devel-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-devel-2.36.7-1.el9_1.2.x86_64.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-devel-debuginfo-2.36.7-1.el9_1.2.x86_64.rpm
webkit2gtk3-jsc-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-jsc-2.36.7-1.el9_1.2.x86_64.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-jsc-debuginfo-2.36.7-1.el9_1.2.x86_64.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-jsc-devel-2.36.7-1.el9_1.2.x86_64.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_1.2.i686.rpm
webkit2gtk3-jsc-devel-debuginfo-2.36.7-1.el9_1.2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2023-23529
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBY/Ze5NzjgjWX9erEAQjtTQ/9GByBcSD74Nq/GLUyBYgxlAtthRuWPMrh
4o4DjAKtv1CmihgE8TZfivRQIE6A/uJf10/GbFV2VjH5sTsRQF/OaMZR7c7JNOVW
mdmTiP2b3uHmTvJV2bQVkZ15sZssJmLBCAQn63TjC1LSkoeMkUm9erfYs+pey2/Q
QSImwWiCb9gQWKkck+85bVBNCxuA97rRxn28nYWqR1HgggcgE+3Z7uWVGZ3r5IyK
f7E+poKT4kN4n3a7YCEDattQae2lida3WY2mWKrVgJi7ICIcJRyWhHeZACfnzExi
462Qsyy7iVOxMPnqEfRT6vk82qSHLl6FTRysuzYz7JnsLHbrcWUqVpySJWdlaK3z
71UUxYndi5h1zsgoGfHkIpr1LmlVNmxQp1FO3kCPGyhyHvNX/xB57EqLmaxxYDuF
NfptkDxuIIaXtg2m1k0vbHssVPiifJRVGVMsJ6mWK9BBo+RQn1uy+k9zRJDrUDU7
tYtf8SjzQBMu2ovl7r2vkVBMwaei3xtPKdIl4HSY3O5dhr+qOc4pun8zN4s1Q/9w
kMRF5rVmZ5I3xbTWijv/2GBlANKp3TlNCIhD2VUNgjj1+mpg/lQtgn/PkDeh/wN/
veHLjyQw26Yh/7c49KNv5RlTznSvyfXR52iJrODtltOtsUxft4TLjgZixn0RtiZp
5PXJxFX5UuI=9kQO
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Apple on Wednesday released a slew of updates for iOS, iPadOS, macOS, watchOS, and Safari browser to address a set of flaws it said were actively exploited in the wild. This includes a pair of zero-days that have been weaponized in a mobile surveillance campaign called Operation Triangulation that has been active since 2019. The exact threat actor behind the campaign is not known.
Apple on Thursday rolled out security updates to iOS, iPadOS, macOS, tvOS, watchOS, and the Safari web browser to address three new zero-day flaws that it said are being actively exploited in the wild. The three security shortcomings are listed below - CVE-2023-32409 - A WebKit flaw that could be exploited by a malicious actor to break out of the Web Content sandbox. It was addressed with
Categories: Apple Categories: Exploits and vulnerabilities Categories: News Tags: macOS Tags: iOS Tags: iPadOS Tags: watchOS Tags: tvOS Tags: Studio Display Tags: CVE-2023-23529 Tags: type confusion Tags: emoji Apple has released security updates and new features for several of its products, including a fix for an actively exploited vulnerability. (Read more...) The post Update now! Apple fixes actively exploited vulnerability and introduces new features appeared first on Malwarebytes Labs.
Plus: Microsoft fixes several zero-day bugs, Google patches Chrome and Android, Mozilla rids Firefox of a full-screen vulnerability, and more.
A type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2.1, iOS 16.3.1 and iPadOS 16.3.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
Ubuntu Security Notice 5893-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
Red Hat Security Advisory 2023-0902-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include a code execution vulnerability.
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-23529: A vulnerability was found in WebKitGTK. This issue occurs when processing maliciously crafted web content in WebKit. This may, in theory, allow a remote attacker to create a specially crafted web page, trick the victim into opening it, trigger type confusion, and execute arbitrary code on the target system.
Debian Linux Security Advisory 5352-1 - An anonymous researcher discovered that processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Debian Linux Security Advisory 5351-1 - An anonymous researcher discovered that processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Hey 👋 there, cyber friends! Welcome to this week's cybersecurity newsletter, where we aim to keep you informed and empowered in the ever-changing world of cyber threats. In today's edition, we will cover some interesting developments in the cybersecurity landscape and share some insightful analysis of each to help you protect yourself against potential attacks. 1. Apple 📱 Devices Hacked with
Apple Security Advisory 2023-02-13-3 - Safari 16.3.1 addresses a code execution vulnerability.
Apple Security Advisory 2023-02-13-2 - macOS Ventura 13.2.1 addresses code execution and use-after-free vulnerabilities.
Apple Security Advisory 2023-02-13-1 - iOS 16.3.1 and iPadOS 16.3.1 addresses code execution and use-after-free vulnerabilities.
By Deeba Ahmed If you are using an Apple product, it is time to update it right now and make sure the automatic updates are enabled. This is a post from HackRead.com Read the original post: Update Now: iOS Devices Receive Vital Security Updates from Apple
Apple on Monday rolled out security updates for iOS, iPadOS, macOS, and Safari to address a zero-day flaw that it said has been actively exploited in the wild. Tracked as CVE-2023-23529, the issue relates to a type confusion bug in the WebKit browser engine that could be activated when processing maliciously crafted web content, culminating in arbitrary code execution. The iPhone maker said the