This update for webkit2gtk3 fixes the following issues:
Update to version 2.46.3 (bsc#1232747), including fixes for:
- CVE-2024-44308: Fixed arbitrary code execution by not allocating DFG register after a slow path (bsc#1233631).
- CVE-2024-44309: Fixed a data isolation bypass vulnerability (bsc#1233632).
- CVE-2024-44244: Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2024-44296: Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.44.3 (bsc#1228696 bsc#1228697 bsc#1228698):
- Fix web process cache suspend/resume when sandbox is enabled.
- Fix accelerated images dissapearing after scrolling.
- Fix video flickering with DMA-BUF sink.
- Fix pointer lock on X11.
- Fix movement delta on mouse events in GTK3.
- Undeprecate console message API and make it available in 2022 API.
- Fix several crashes and rendering issues.
- Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
CVE-2024-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
CVE-2024-4558.
This update for webkit2gtk3 fixes the following issues:
- CVE-2024-40776: Fixed a use-after-free issue with improved memory management (bsc#1228613).
- CVE-2024-40779: Fixed a out-of-bounds read with improved bounds checking (bsc#1228693).
- CVE-2024-40780: Fixed another out-of-bounds read with improved bounds checking (bsc#1228694).
- CVE-2024-40782: Fixed a second use-after-free issue with improved memory management (bsc#1228695).
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.44.2
- CVE-2024-27834: Fixed a vulnerability where an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. (bsc#1225071)
This update for webkit2gtk3 fixes the following issues:
- CVE-2024-23252: Fixed denial of service via crafted web content (bsc#1222010).
- CVE-2024-23254: Fixed possible audio data exilftration cross-origin via malicious website (bsc#1222010).
- CVE-2024-23263: Fixed lack of Content Security Policy enforcing via malicious crafted web content (bsc#1222010).
- CVE-2024-23280: Fixed possible user fingeprint via malicious crafted web content (bsc#1222010).
- CVE-2024-23284: Fixed lack of Content Security Policy enforcing via malicious crafted web content
This update for webkit2gtk3 fixes the following issues:
Update to version 2.42.5 (bsc#1219604):
- CVE-2024-23222: Fixed processing maliciously crafted web content that may have led to arbitrary code execution (bsc#1219113).
- CVE-2024-23206: Fixed fingerprint user via maliciously crafted webpages (bsc#1219604).
- CVE-2024-23213: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).
- CVE-2023-40414: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).
- CVE-2014-1745: Fixed denial-of-service or potentially disclose memory contents while processing maliciously crafted f
This update for webkit2gtk3 fixes the following issues:
- CVE-2024-23222: Fixed type confusion that may lead to arbitrary code execution. (bsc#1219113)
This update for webkit2gtk3 fixes the following issues:
- CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033).
- CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032).
- CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870).
- CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1215868).
This update for webkit2gtk3 fixes the following issues:
Update to version 2.42.3 (bsc#1217844):
- Fix flickering while playing videos with DMA-BUF sink.
- Fix color picker being triggered in the inspector when typing 'tan'.
- Do not special case the 'sans' font family name.
- Fix build failure with libxml2 version 2.12.0 due to an API change.
- Fix several crashes and rendering issues.
- Security fixes: CVE-2023-42916, CVE-2023-42917.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.42.2 (bsc#1217210):
- CVE-2023-41983: Processing web content may lead to a denial-of-service.
- CVE-2023-42852: Processing web content may lead to arbitrary code execution.
Already previousl
This update for webkit2gtk3 fixes the following issues:
- CVE-2023-41993: Fixed an issue where processing malicious web
content could have lead to arbitrary code execution (bsc#1215661).
- CVE-2023-39928: Fixed a use-after-free that could be exploited to
execute arbitrary code when visiting a malicious webpage
(bsc#1215868).
- CVE-2023-41074: Fixed an issue where processing malicious web
content could have lead to arbitrary code execution (bsc#1215870).
Non-security fixes:
- Fixed missing package dependencies (bsc#1215072).
This update for webkit2gtk3 fixes the following issues:
Add security patches (bsc#1211846):
- CVE-2023-28204: Fixed processing of web content that may disclose sensitive information (bsc#1211659).
- CVE-2023-32373: Fixed processing of maliciously crafted web content that may lead to arbitrary code execution (bsc#1211658).
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.6 (bsc#1210731):
- CVE-2022-0108: Fixed information leak.
- CVE-2022-32885: Fixed arbitrary code execution.
- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
- CVE-2023-27932: Fixed Same Origin Policy bypass.
- CVE-2023-27954: Fixed sensitive user information tracking.
- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).
Already fixed in version 2.38.5:
- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.5 (boo#1208328):
- CVE-2023-23529: Fixed possible arbitrary code execution via maliciously crafted web content.
Update to version 2.38.4 (boo#1207997):
- CVE-2023-23517: Fixed web content processing that could have led to arbitrary code execution.
- CVE-2023-23518: Fixed web content processing that could have led to arbitrary code execution.
- CVE-2022-42826: Fixed a use-after-free issue that was caused by improper memory management.
New CVE and bug references where added for already released updates:
Update to version 2.38.3 (boo#1206750):
- CVE-2022-42852
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.3:
- CVE-2022-42856: Fixed a potential arbitrary code execution when processing maliciously crafted web content (bsc#1206474).
- CVE-2022-42852: Fixed disclosure of process memory by improved memory handling.
- CVE-2022-42867: Fixed a use after free issue was addressed with improved memory management.
- CVE-2022-46692: Fixed bypass of Same Origin Policy through improved state management.
- CVE-2022-46698: Fixed disclosure of sensitive user information with improved checks.
- CVE-2022-46699: Fixed an arbitrary code execution caused by memory corruption.
- CVE-2022
Security fixes:
- CVE-2022-32888: Fixed possible arbitrary code execution via maliciously crafted web content (bsc#1205121).
- CVE-2022-32923: Fixed possible information leak via maliciously crafted web content (bsc#1205122).
- CVE-2022-42799: Fixed user interface spoofing when visiting a malicious website (bsc#1205123).
- CVE-2022-42823: Fixed possible arbitrary code execution via maliciously crafted web content (bsc#1205120).
- CVE-2022-42824: Fixed possible sensitive user information leak via maliciously crafted web content (bsc#1205124).
Update to version 2.38.2:
- Fix scrolling issues in some sites having fixed background.
- Fix
This update for webkit2gtk3 fixes the following issues:
Updated to version 2.36.8 (bsc#1203530):
- CVE-2022-32886: Fixed a buffer overflow issue that could potentially lead to code execution.
- CVE-2022-32912: Fixed an out-of-bounds read that could potentially lead to code execution.
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.36.5 (bsc#1201980):
- Add support for PAC proxy in the WebDriver implementation.
- Fix video playback when loaded through custom URIs, this fixes
video playback in the Yelp documentation browser.
- Fix WebKitWebView::context-menu when using GTK4.
- Fix LTO builds with GCC.
- Fix several crashes and rendering issues.
- Security fixes:
- CVE-2022-32792: Fixed processing maliciously crafted web content may lead to
arbitrary code execution.
- CVE-2022-32816: Fixed visiting a website that frames malicious content may lead to
UI spoofing.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.36.4 (bsc#1201221):
- CVE-2022-22662: Processing maliciously crafted web content may disclose sensitive user information.
- CVE-2022-22677: The video in a webRTC call may be interrupted if the audio capture gets interrupted.
- CVE-2022-26710: Processing maliciously crafted web content may lead to arbitrary code execution.