QID 750913

Date Published: 2021-08-05

QID 750913: SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2021:2600-1)

This update for webkit2gtk3 fixes the following issues: update to version 2.32.3: - cve-2021-21775: fixed a use-after-free vulnerability in the way certain events are processed for imageloader objects.
A specially crafted web page can lead to a potential information leak and further memory corruption.
A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (
Bsc#1188697) - cve-2021-21779: fixed a use-after-free vulnerability in the way that webkit graphicscontext handles certain events.
Bsc#1188697) - cve-2021-30663: an integer overflow was addressed with improved input validation. (
Bsc#1188697) - cve-2021-30665: a memory corruption issue was addressed with improved state management. (
Bsc#1188697) - cve-2021-30689: a logic issue was addressed with improved state management. (
Bsc#1188697) - cve-2021-30720: a logic issue was addressed with improved restrictions.
(bsc#1188697) - cve-2021-30734: multiple memory corruption issues were addressed with improved memory handling. (
Bsc#1188697) - cve-2021-30744: a cross-origin issue with iframe elements was addressed with improved tracking of security origins. (
Bsc#1188697) - cve-2021-30749: multiple memory corruption issues were addressed with improved memory handling. (
Bsc#1188697) - cve-2021-30758: a type confusion issue was addressed with improved state handling. (
Bsc#1188697) - cve-2021-30795: a use after free issue was addressed with improved memory management. (
Bsc#1188697) - cve-2021-30797: this issue was addressed with improved checks.
(bsc#1188697) - cve-2021-30799: multiple memory corruption issues were addressed with improved memory handling. (

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation allows attacker to compromise the system.

  • CVSS V3 rated as Critical - 8.8 severity.
  • CVSS V2 rated as High - 6.8 severity.
  • Solution
    Upgrade to the latest package which contains the patch. To install this SUSE Security, Update use YaST online_update. Alternatively you can run the command listed for your product. To install packages using the command line interface, use command "yum update". Refer to Suse security advisory: SUSE-SU-2021:2600-1 to address this issue and obtain further details.
    Software Advisories
    Advisory ID Software Component Link
    SUSE-SU-2021:2600-1 SUSE Enterprise Linux URL Logo lists.suse.com/pipermail/sle-security-updates/2021-August/009245.html