This update for webkit2gtk3 fixes the following issues:
- CVE-2023-41993: Fixed an issue where processing malicious web
content could have lead to arbitrary code execution (bsc#1215661).
- CVE-2023-39928: Fixed a use-after-free that could be exploited to
execute arbitrary code when visiting a malicious webpage
(bsc#1215868).
- CVE-2023-41074: Fixed an issue where processing malicious web
content could have lead to arbitrary code execution (bsc#1215870).
Non-security fixes:
- Fixed missing package dependencies (bsc#1215072).
This update for webkit2gtk3 fixes the following issues:
Add security patches (bsc#1211846):
- CVE-2023-28204: Fixed processing of web content that may disclose sensitive information (bsc#1211659).
- CVE-2023-32373: Fixed processing of maliciously crafted web content that may lead to arbitrary code execution (bsc#1211658).
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.6 (bsc#1210731):
- CVE-2022-0108: Fixed information leak.
- CVE-2022-32885: Fixed arbitrary code execution.
- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
- CVE-2023-27932: Fixed Same Origin Policy bypass.
- CVE-2023-27954: Fixed sensitive user information tracking.
- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).
Already fixed in version 2.38.5:
- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.5 (boo#1208328):
- CVE-2023-23529: Fixed possible arbitrary code execution via maliciously crafted web content.
Update to version 2.38.4 (boo#1207997):
- CVE-2023-23517: Fixed web content processing that could have led to arbitrary code execution.
- CVE-2023-23518: Fixed web content processing that could have led to arbitrary code execution.
- CVE-2022-42826: Fixed a use-after-free issue that was caused by improper memory management.
New CVE and bug references where added for already released updates:
Update to version 2.38.3 (boo#1206750):
- CVE-2022-42852
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.3:
- CVE-2022-42856: Fixed a potential arbitrary code execution when processing maliciously crafted web content (bsc#1206474).
- CVE-2022-42852: Fixed disclosure of process memory by improved memory handling.
- CVE-2022-42867: Fixed a use after free issue was addressed with improved memory management.
- CVE-2022-46692: Fixed bypass of Same Origin Policy through improved state management.
- CVE-2022-46698: Fixed disclosure of sensitive user information with improved checks.
- CVE-2022-46699: Fixed an arbitrary code execution caused by memory corruption.
- CVE-2022
Security fixes:
- CVE-2022-32888: Fixed possible arbitrary code execution via maliciously crafted web content (bsc#1205121).
- CVE-2022-32923: Fixed possible information leak via maliciously crafted web content (bsc#1205122).
- CVE-2022-42799: Fixed user interface spoofing when visiting a malicious website (bsc#1205123).
- CVE-2022-42823: Fixed possible arbitrary code execution via maliciously crafted web content (bsc#1205120).
- CVE-2022-42824: Fixed possible sensitive user information leak via maliciously crafted web content (bsc#1205124).
Update to version 2.38.2:
- Fix scrolling issues in some sites having fixed background.
- Fix
This update for webkit2gtk3 fixes the following issues:
Updated to version 2.36.8 (bsc#1203530):
- CVE-2022-32886: Fixed a buffer overflow issue that could potentially lead to code execution.
- CVE-2022-32912: Fixed an out-of-bounds read that could potentially lead to code execution.
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.36.5 (bsc#1201980):
- Add support for PAC proxy in the WebDriver implementation.
- Fix video playback when loaded through custom URIs, this fixes
video playback in the Yelp documentation browser.
- Fix WebKitWebView::context-menu when using GTK4.
- Fix LTO builds with GCC.
- Fix several crashes and rendering issues.
- Security fixes:
- CVE-2022-32792: Fixed processing maliciously crafted web content may lead to
arbitrary code execution.
- CVE-2022-32816: Fixed visiting a website that frames malicious content may lead to
UI spoofing.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.36.4 (bsc#1201221):
- CVE-2022-22662: Processing maliciously crafted web content may disclose sensitive user information.
- CVE-2022-22677: The video in a webRTC call may be interrupted if the audio capture gets interrupted.
- CVE-2022-26710: Processing maliciously crafted web content may lead to arbitrary code execution.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.36.3 (bsc#1200106)
- CVE-2022-30293: Fixed heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer (bsc#1199287).
- CVE-2022-26700: Fixed memory corruption issue that may lead to code execution when processing maliciously crafted web content (bsc#1200106).
- CVE-2022-26709: Fixed use after free issue that may lead to code execution when processing maliciously crafted web content (bsc#1200106).
- CVE-2022-26716: Fixed use after free issue that may lead to code execution when processing maliciously crafted web content (bsc#1200106).
- CVE-2022-2671
This update for webkit2gtk3 fixes the following issues:
Update to version 2.36.0 (bsc#1198290):
- CVE-2022-22624: Fixed use after free that may lead to arbitrary code execution.
- CVE-2022-22628: Fixed use after free that may lead to arbitrary code execution.
- CVE-2022-22629: Fixed a buffer overflow that may lead to arbitrary code execution.
- CVE-2022-22637: Fixed an unexpected cross-origin behavior due to a logic error.
Missing CVE reference for the update to 2.34.6 (bsc#1196133):
- CVE-2022-22594: Fixed a cross-origin issue in the IndexDB API.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.34.6 (bsc#1196133):
- CVE-2022-22620: Processing maliciously crafted web content may have lead to arbitrary code execution.
Update to version 2.34.5 (bsc#1195735):
- CVE-2022-22589: A validation issue was addressed with improved input sanitization.
- CVE-2022-22590: A use after free issue was addressed with improved memory management.
- CVE-2022-22592: A logic issue was addressed with improved state management.
Update to version 2.34.4 (bsc#1195064):
- CVE-2021-30934: A buffer overflow issue was addressed with improved memory handling.
- CVE-2021-30936: A use af
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.34.3 (bsc#1194019).
- CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when processing maliciously crafted web content.
- CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously crafted web content.