{"id":"ALSA-2022:1777","summary":"Moderate: webkit2gtk3 security, bug fix, and enhancement update","details":"WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nThe following packages have been upgraded to a later upstream version: webkit2gtk3 (2.34.6). (BZ#1985042)\n\nSecurity Fix(es):\n\n* webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free (CVE-2022-22620)\n\n* webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)\n\n* webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)\n\n* webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)\n\n* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)\n\n* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)\n\n* webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)\n\n* webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)\n\n* webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)\n\n* webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)\n\n* webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)\n\n* webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)\n\n* webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)\n\n* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30934)\n\n* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30936)\n\n* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30951)\n\n* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30952)\n\n* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30953)\n\n* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30954)\n\n* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30984)\n\n* webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create (CVE-2021-45481)\n\n* webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)\n\n* webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)\n\n* webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript (CVE-2022-22589)\n\n* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-22590)\n\n* webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2022-22592)\n\n* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)\n\n* webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)\n\n* webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)\n\n* webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","modified":"2026-01-30T00:40:57.537688Z","published":"2022-05-10T06:24:27Z","related":["CVE-2021-30809","CVE-2021-30818","CVE-2021-30823","CVE-2021-30836","CVE-2021-30846","CVE-2021-30848","CVE-2021-30849","CVE-2021-30851","CVE-2021-30884","CVE-2021-30887","CVE-2021-30888","CVE-2021-30889","CVE-2021-30890","CVE-2021-30897","CVE-2021-30934","CVE-2021-30936","CVE-2021-30951","CVE-2021-30952","CVE-2021-30953","CVE-2021-30954","CVE-2021-30984","CVE-2021-45481","CVE-2021-45482","CVE-2021-45483","CVE-2022-22589","CVE-2022-22590","CVE-2022-22592","CVE-2022-22594","CVE-2022-22620","CVE-2022-22637"],"references":[{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2022-1777.html"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30809"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30818"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30823"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30836"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30846"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30848"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30849"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30851"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30884"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30887"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30888"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30889"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30890"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30897"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30934"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30936"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30951"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30952"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30953"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30954"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-30984"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-45481"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-45482"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2021-45483"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2022-22589"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2022-22590"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2022-22592"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2022-22594"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2022-22620"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2022-22637"}],"affected":[{"package":{"name":"webkit2gtk3","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/webkit2gtk3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.6-1.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2022:1777.json"}},{"package":{"name":"webkit2gtk3-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/webkit2gtk3-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.6-1.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2022:1777.json"}},{"package":{"name":"webkit2gtk3-jsc","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/webkit2gtk3-jsc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.6-1.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2022:1777.json"}},{"package":{"name":"webkit2gtk3-jsc-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/webkit2gtk3-jsc-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.6-1.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2022:1777.json"}}],"schema_version":"1.7.3"}