ALT-BU-2022-6328-1
Branch sisyphus_riscv64 update bulletin.
Package libvirglrenderer updated to version 0.10.3-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-0135
An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a denial of service or possible code execution.
- https://bugzilla.redhat.com/show_bug.cgi?id=2037790
- https://bugzilla.redhat.com/show_bug.cgi?id=2037790
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
- GLSA-202210-05
- GLSA-202210-05
Modified: 2024-11-21
CVE-2022-0175
A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.
- https://access.redhat.com/security/cve/CVE-2022-0175
- https://access.redhat.com/security/cve/CVE-2022-0175
- https://bugzilla.redhat.com/show_bug.cgi?id=2039003
- https://bugzilla.redhat.com/show_bug.cgi?id=2039003
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654
- https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654
- GLSA-202210-05
- GLSA-202210-05
- https://security-tracker.debian.org/tracker/CVE-2022-0175
- https://security-tracker.debian.org/tracker/CVE-2022-0175
Package libwebkitgtk4 updated to version 2.38.0-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-03-07
CVE-2023-25358
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- [oss-security] 20230421 WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003
- [oss-security] 20230421 WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003
- https://bugs.webkit.org/show_bug.cgi?id=242683
- https://bugs.webkit.org/show_bug.cgi?id=242683
- FEDORA-2023-a4bbf02a57
- FEDORA-2023-a4bbf02a57
- FEDORA-2023-5b61346bbe
- FEDORA-2023-5b61346bbe
- FEDORA-2023-8900b35c6f
- FEDORA-2023-8900b35c6f
- GLSA-202305-32
- GLSA-202305-32
Modified: 2025-03-07
CVE-2023-25360
A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Modified: 2025-03-07
CVE-2023-25361
A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Modified: 2024-11-21
CVE-2023-25362
A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Modified: 2024-11-21
CVE-2023-25363
A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Package libwebkitgtk4.1 updated to version 2.38.0-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-03-07
CVE-2023-25358
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- [oss-security] 20230421 WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003
- [oss-security] 20230421 WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003
- https://bugs.webkit.org/show_bug.cgi?id=242683
- https://bugs.webkit.org/show_bug.cgi?id=242683
- FEDORA-2023-a4bbf02a57
- FEDORA-2023-a4bbf02a57
- FEDORA-2023-5b61346bbe
- FEDORA-2023-5b61346bbe
- FEDORA-2023-8900b35c6f
- FEDORA-2023-8900b35c6f
- GLSA-202305-32
- GLSA-202305-32
Modified: 2025-03-07
CVE-2023-25360
A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Modified: 2025-03-07
CVE-2023-25361
A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Modified: 2024-11-21
CVE-2023-25362
A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Modified: 2024-11-21
CVE-2023-25363
A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely.