-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-5684-1                   security@debian.org
https://www.debian.org/security/                           Alberto Garcia
May 09, 2024                          https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : webkit2gtk
CVE ID         : CVE-2023-42843 CVE-2023-42950 CVE-2023-42956 CVE-2024-23252
                 CVE-2024-23254 CVE-2024-23263 CVE-2024-23280 CVE-2024-23284

The following vulnerabilities have been discovered in the WebKitGTK
web engine:

CVE-2023-42843

    Kacper Kwapisz discovered that visiting a malicious website may
    lead to address bar spoofing.

CVE-2023-42950

    Nan Wang and Rushikesh Nandedkar discovered that processing
    maliciously crafted web content may lead to arbitrary code
    execution.

CVE-2023-42956

    SungKwon Lee discovered that processing web content may lead to a
    denial-of-service.

CVE-2024-23252

    anbu1024 discovered that processing web content may lead to a
    denial-of-service.

CVE-2024-23254

    James Lee discovered that a malicious website may exfiltrate audio
    data cross-origin.

CVE-2024-23263

    Johan Carlsson discovered that processing maliciously crafted web
    content may prevent Content Security Policy from being enforced.

CVE-2024-23280

    An anonymous researcher discovered that a maliciously crafted
    webpage may be able to fingerprint the user.

CVE-2024-23284

    Georg Felber and Marco Squarcina discovered that processing
    maliciously crafted web content may prevent Content Security
    Policy from being enforced.

For the oldstable distribution (bullseye), these problems have been fixed
in version 2.44.1-1~deb11u1.

For the stable distribution (bookworm), these problems have been fixed in
version 2.44.1-1~deb12u1.

We recommend that you upgrade your webkit2gtk packages.

For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org