ALT-PU-2021-3571-1
Package libwebkitgtk4 updated to version 2.34.3-alt1 for branch sisyphus in task 292374.
Closed vulnerabilities
BDU:2021-06030
Уязвимость модуля отображения веб-страниц WPE WebKit браузера Safari для операционных систем iOS, iPadOS, tvOS, watchOS, macOS, связанная с ошибками смешения типов данных, позволяющая нарушителю выполнить произвольный код
BDU:2021-06107
Уязвимость модуля отображения веб-страниц WPE WebKit браузера Safari для операционных систем iOS, iPadOS, tvOS, watchOS, macOS, связанная с использованием памяти после ее освобождения, позволяющая нарушителю выполнить произвольный код
BDU:2022-00665
Уязвимость модулей отображения веб-страниц WebKitGTK и WPE WebKit, связанная с чтением за границами буфера в памяти, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-05674
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05675
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с использованием открытой переадресации, позволяющая нарушителю получить доступ к конфиденциальным данным
BDU:2022-05694
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с копированием буфера без проверки входных данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-05708
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с использованием недоверенного файла междоменной политики, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05779
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с передачей защищаемой информации в незашифрованном виде, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05787
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю получить доступ к конфиденциальным данным
Modified: 2024-11-21
CVE-2021-30809
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30818
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30823
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/kb/HT212953
- https://support.apple.com/kb/HT212953
Modified: 2024-11-21
CVE-2021-30836
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212816
- https://support.apple.com/kb/HT212816
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30887
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- FEDORA-2022-25a98f5d55
- FEDORA-2022-25a98f5d55
- FEDORA-2022-f7366e60cb
- FEDORA-2022-f7366e60cb
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
- DSA-5030
- DSA-5030
- DSA-5031
- DSA-5031
Modified: 2024-11-21
CVE-2021-30888
An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content Security Policy reports may be able to leak information via redirect behavior .
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212868
- https://support.apple.com/en-us/HT212868
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
Modified: 2024-11-21
CVE-2021-30889
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
Modified: 2024-11-21
CVE-2021-30890
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to universal cross site scripting.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- FEDORA-2022-25a98f5d55
- FEDORA-2022-25a98f5d55
- FEDORA-2022-f7366e60cb
- FEDORA-2022-f7366e60cb
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
- DSA-5030
- DSA-5030
- DSA-5031
- DSA-5031
Modified: 2024-11-21
CVE-2021-30897
An issue existed in the specification for the resource timing API. The specification was updated and the updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website may exfiltrate data cross-origin.