Mageia 2021-0400: webkit2 security update
Summary
Updated webkit2 packages fix security vulnerabilities:
A use-after-free vulnerability exists in the way certain events are
processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially
crafted web page can lead to a potential information leak and further
memory corruption. In order to trigger the vulnerability, a victim must
be tricked into visiting a malicious webpage (CVE-2021-21775).
A use-after-free vulnerability exists in the way Webkit GraphicsContext
handles certain events in WebKitGTK 2.30.4. A specially crafted web page
can lead to a potential information leak and further memory corruption.
A victim must be tricked into visiting a malicious web page to trigger
this vulnerability (CVE-2021-21779).
Processing maliciously crafted web content may lead to arbitrary code
execution (CVE-2021-30663, CVE-2021-30665, CVE-2021-30734, CVE-2021-30749,
CVE-2021-30758, CVE-2021-30795, CVE-2021-30797, CVE-2021-30799).
Processing maliciously crafted web content may lead to universal cross
site scripting (CVE-2021-30689, CVE-2021-30744).
A malicious website may be able to access restricted ports on arbitrary
servers (CVE-2021-30720).
References
- https://bugs.mageia.org/show_bug.cgi?id=29282
- https://webkitgtk.org/2021/07/09/webkitgtk2.32.2-released.html
- https://webkitgtk.org/2021/07/23/webkitgtk2.32.3-released.html
- https://webkitgtk.org/security/WSA-2021-0004.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21775
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21779
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30663
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30665
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30689
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30720
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30734
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30744
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30749
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30758
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30795
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30797
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30799
Resolution
MGASA-2021-0400 - Updated webkit2 packages fix security vulnerabilities
SRPMS
- 8/core/webkit2-2.32.3-1.mga8