ALSA-2020:4451 - Moderate: GNOME security, bug fix, and enhancement update
Summary
ALSA-2020:4451: Moderate: GNOME security, bug fix, and enhancement update. Affects LibRaw-devel versions < 0.19.5-2.el8. Fixed in 0.19.5-2.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNOME is the default desktop environment of AlmaLinux. It provides a user-friendly and visually appealing interface for Linux systems. The affected packages in this update include gnome-remote-desktop, pipewire, vte291, webkit2gtk3, xdg-desktop-portal, and xdg-desktop-portal-gtk.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the GNOME packages. The most significant vulnerability is in webkitgtk, which is used for web content rendering. These vulnerabilities could allow an attacker to execute arbitrary code, bypass security restrictions, or cause denial of service. Another vulnerability affects gnome-settings-daemon, where the AlmaLinux Customer Portal password was logged and passed as a command-line argument when a user registered through the GNOME control center. Additionally, LibRaw had a vulnerability that could lead to a buffer overflow due to a lack of thumbnail size range check.
How To Fix
Minimum fixed version
0.19.5-2.el8
This is the first release that contains the fix.
sudo dnf update LibRaw-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple security vulnerabilities in GNOME packages, including webkitgtk, gnome-settings-daemon, and LibRaw. It is crucial to update the affected packages to ensure the security and stability of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for LibRaw-devel →
FAQ
GNOME is a desktop environment for Linux systems that provides a user-friendly interface and various applications.
webkitgtk is a web content rendering engine used by GNOME and other applications.
The vulnerabilities could allow attackers to execute arbitrary code, bypass security restrictions, or cause denial of service.
To update the affected packages, refer to the AlmaLinux Release Notes for the specific fixed versions and follow the update instructions.
No workaround has been provided for these vulnerabilities. It is recommended to update the affected packages.
