ALT-PU-2022-4339-1
Package libwebkitgtk4 updated to version 2.34.6-alt0.1.mips1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2021-06030
Уязвимость модуля отображения веб-страниц WPE WebKit браузера Safari для операционных систем iOS, iPadOS, tvOS, watchOS, macOS, связанная с ошибками смешения типов данных, позволяющая нарушителю выполнить произвольный код
BDU:2021-06107
Уязвимость модуля отображения веб-страниц WPE WebKit браузера Safari для операционных систем iOS, iPadOS, tvOS, watchOS, macOS, связанная с использованием памяти после ее освобождения, позволяющая нарушителю выполнить произвольный код
BDU:2022-00665
Уязвимость модулей отображения веб-страниц WebKitGTK и WPE WebKit, связанная с чтением за границами буфера в памяти, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-05674
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05675
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с использованием открытой переадресации, позволяющая нарушителю получить доступ к конфиденциальным данным
BDU:2022-05694
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с копированием буфера без проверки входных данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-05708
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с использованием недоверенного файла междоменной политики, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05779
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с передачей защищаемой информации в незашифрованном виде, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05787
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю получить доступ к конфиденциальным данным
Modified: 2024-11-21
CVE-2021-30809
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30818
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30823
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/kb/HT212953
- https://support.apple.com/kb/HT212953
Modified: 2024-11-21
CVE-2021-30836
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212816
- https://support.apple.com/kb/HT212816
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30887
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- FEDORA-2022-25a98f5d55
- FEDORA-2022-25a98f5d55
- FEDORA-2022-f7366e60cb
- FEDORA-2022-f7366e60cb
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
- DSA-5030
- DSA-5030
- DSA-5031
- DSA-5031
Modified: 2024-11-21
CVE-2021-30888
An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content Security Policy reports may be able to leak information via redirect behavior .
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212868
- https://support.apple.com/en-us/HT212868
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
Modified: 2024-11-21
CVE-2021-30889
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
Modified: 2024-11-21
CVE-2021-30890
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to universal cross site scripting.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- FEDORA-2022-25a98f5d55
- FEDORA-2022-25a98f5d55
- FEDORA-2022-f7366e60cb
- FEDORA-2022-f7366e60cb
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
- DSA-5030
- DSA-5030
- DSA-5031
- DSA-5031
Modified: 2024-11-21
CVE-2021-30897
An issue existed in the specification for the resource timing API. The specification was updated and the updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website may exfiltrate data cross-origin.
Modified: 2024-11-21
CVE-2021-42762
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- [oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- https://bugs.webkit.org/show_bug.cgi?id=231479
- https://bugs.webkit.org/show_bug.cgi?id=231479
- https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
- https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
- FEDORA-2021-483d896d1d
- FEDORA-2021-483d896d1d
- FEDORA-2021-db6ebb2d68
- FEDORA-2021-db6ebb2d68
- FEDORA-2021-131360fa9a
- FEDORA-2021-131360fa9a
- DSA-4995
- DSA-4995
- DSA-4996
- DSA-4996
Modified: 2024-11-21
CVE-2021-45481
In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application crash, a different vulnerability than CVE-2021-30889.
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
Modified: 2024-11-21
CVE-2021-45482
In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889.
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
Modified: 2024-11-21
CVE-2021-45483
In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-30889.
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3