RHSA-2022:1777MediumCVSS 8.8

Red Hat Security Advisory: webkit2gtk3 security, bug fix, and enhancement update

Published
May 10, 2022
Last Modified
November 9, 2026

🔗 CVE IDs covered (30)

CVE-2021-45482 →CVE-2022-22590 →CVE-2021-30818 →CVE-2021-30848 →CVE-2021-30954 →CVE-2022-22589 →CVE-2021-30836 →CVE-2021-30884 →CVE-2021-30952 →CVE-2021-45481 →CVE-2021-30887 →CVE-2021-30897 →CVE-2021-30934 →CVE-2021-30953 →CVE-2021-45483 →CVE-2022-22594 →CVE-2021-30823 →CVE-2022-22592 →CVE-2021-30849 →CVE-2021-30890 →CVE-2021-30936 →CVE-2022-22620 →CVE-2021-30809 →CVE-2021-30889 →CVE-2022-22637 →CVE-2021-30846 →CVE-2021-30851 →CVE-2021-30888 →CVE-2021-30951 →CVE-2021-30984 →

📋 Description

CVE-2021-30809 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2021-30818 — webkitgtk: Type confusion issue leading to arbitrary code execution CVE-2021-30823 — webkitgtk: Logic issue leading to HSTS bypass CVE-2021-30836 — webkitgtk: Out-of-bounds read leading to memory disclosure CVE-2021-30846 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2021-30848 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2021-30849 — webkitgtk: Multiple memory corruption issue leading to arbitrary code execution CVE-2021-30851 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2021-30884 — webkitgtk: CSS compositing issue leading to revealing of the browsing history CVE-2021-30887 — webkitgtk: Logic issue leading to Content Security Policy bypass CVE-2021-30888 — webkitgtk: Information leak via Content Security Policy reports CVE-2021-30889 — webkitgtk: Buffer overflow leading to arbitrary code execution CVE-2021-30890 — webkitgtk: Logic issue leading to universal cross-site scripting CVE-2021-30897 — webkitgtk: Cross-origin data exfiltration via resource timing API CVE-2021-30934 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30936 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30951 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30952 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30953 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30954 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30984 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-45481 — webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create CVE-2021-45482 — webkitgtk: use-after-free in WebCore::ContainerNode::firstChild CVE-2021-45483 — webkitgtk: use-after-free in WebCore::Frame::page CVE-2022-22589 — webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript CVE-2022-22590 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2022-22592 — webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced CVE-2022-22594 — webkitgtk: A malicious website may exfiltrate data cross-origin CVE-2022-22620 — webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free CVE-2022-22637 — webkitgtk: logic issue was addressed with improved state management

🎯 Affected products47

  • Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.34.6-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.34.6-1.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.34.6-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.34.6-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.34.6-1.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.34.6-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.34.6-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.34.6-1.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.34.6-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.34.6-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.34.6-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.34.6-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.34.6-1.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.34.6-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.34.6-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.34.6-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.34.6-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.34.6-1.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.34.6-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.34.6-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.34.6-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.34.6-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.34.6-1.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.34.6-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.34.6-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.34.6-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-jsc-0:2.34.6-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-jsc-0:2.34.6-1.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-jsc-0:2.34.6-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +17 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (36)