Advisories ยป MGASA-2021-0400

Updated webkit2 packages fix security vulnerabilities

Publication date: 14 Aug 2021
Modification date: 14 Aug 2021
Type: security
Affected Mageia releases : 8
CVE: CVE-2021-21775 , CVE-2021-21779 , CVE-2021-30663 , CVE-2021-30665 , CVE-2021-30689 , CVE-2021-30720 , CVE-2021-30734 , CVE-2021-30744 , CVE-2021-30749 , CVE-2021-30758 , CVE-2021-30795 , CVE-2021-30797 , CVE-2021-30799

Description

Updated webkit2 packages fix security vulnerabilities:

A use-after-free vulnerability exists in the way certain events are
processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially
crafted web page can lead to a potential information leak and further
memory corruption. In order to trigger the vulnerability, a victim must
be tricked into visiting a malicious webpage (CVE-2021-21775).

A use-after-free vulnerability exists in the way Webkit GraphicsContext
handles certain events in WebKitGTK 2.30.4. A specially crafted web page
can lead to a potential information leak and further memory corruption.
A victim must be tricked into visiting a malicious web page to trigger
this vulnerability (CVE-2021-21779).

Processing maliciously crafted web content may lead to arbitrary code
execution (CVE-2021-30663, CVE-2021-30665, CVE-2021-30734, CVE-2021-30749,
CVE-2021-30758, CVE-2021-30795, CVE-2021-30797, CVE-2021-30799).

Processing maliciously crafted web content may lead to universal cross
site scripting (CVE-2021-30689, CVE-2021-30744).

A malicious website may be able to access restricted ports on arbitrary
servers (CVE-2021-30720).

References

SRPMS

8/core