Moderate: webkit2gtk3 security and bug fix update
Summary
ALSA-2022:8054: Moderate: webkit2gtk3 security and bug fix update. Affects webkit2gtk3 versions < 2.36.7-1.el9. Fixed in 2.36.7-1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. It provides a framework for building web browsers and other applications that display web content. The webkit2gtk3 package is specifically designed for AlmaLinux 9. It is used by various applications to render web content and provide a browsing experience. However, this package is vulnerable to multiple security issues that could lead to arbitrary code execution and sensitive user information disclosure.
Vulnerability Detail
The webkit2gtk3 package is affected by several vulnerabilities:
- CVE-2022-22624: Use-after-free leading to arbitrary code execution
- CVE-2022-22628: Use-after-free leading to arbitrary code execution
- CVE-2022-22629: Buffer overflow leading to arbitrary code execution
- CVE-2022-22662: Cookie management issue leading to sensitive user information disclosure
- CVE-2022-26700: Memory corruption issue leading to arbitrary code execution
- CVE-2022-26709: Use-after-free leading to arbitrary code execution
- CVE-2022-26710: Use-after-free leading to arbitrary code execution
- CVE-2022-26716: Memory corruption issue leading to arbitrary code execution
- CVE-2022-26717: Use-after-free leading to arbitrary code execution
- CVE-2022-26719: Memory corruption issue leading to arbitrary code execution
- CVE-2022-30293: Heap buffer overflow leading to arbitrary code execution
These vulnerabilities can be exploited by attackers to execute arbitrary code on the affected system or disclose sensitive user information. The impact of these vulnerabilities can vary depending on the context in which the webkit2gtk3 package is used.
How To Fix
Minimum fixed version
2.36.7-1.el9
This is the first release that contains the fix.
sudo dnf update webkit2gtk3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. The recommended approach is to update the webkit2gtk3 package to the fixed version.
Conclusion
The webkit2gtk3 package in AlmaLinux 9 is vulnerable to multiple security issues that can lead to arbitrary code execution and sensitive user information disclosure. To mitigate these vulnerabilities, it is crucial to update the package to version 2.36.7-1.el9 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for webkit2gtk3 →
FAQ
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. It provides a framework for building web browsers and other applications that display web content.
The vulnerabilities in webkit2gtk3 include use-after-free, buffer overflow, cookie management issue, memory corruption, and heap buffer overflow. These vulnerabilities can lead to arbitrary code execution and sensitive user information disclosure.
The impact of these vulnerabilities can vary depending on the context in which the webkit2gtk3 package is used. They can allow attackers to execute arbitrary code on the affected system or disclose sensitive user information.
To fix these vulnerabilities, it is recommended to update the webkit2gtk3 package to version 2.36.7-1.el9 or later. This version includes security fixes for all the mentioned vulnerabilities.
For more details about these vulnerabilities, including the impact, CVSS scores, and acknowledgments, refer to the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for webkit2gtk3.
