MGASA-2021-0400

Dashboard / Vulnerabilities / MGASA-2021-0400

MGASA-2021-0400

Summary: Updated webkit2 packages fix security vulnerabilities

Details: Updated webkit2 packages fix security vulnerabilities: A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage (CVE-2021-21775). A use-after-free vulnerability exists in the way Webkit GraphicsContext handles certain events in WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability (CVE-2021-21779). Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30663, CVE-2021-30665, CVE-2021-30734, CVE-2021-30749, CVE-2021-30758, CVE-2021-30795, CVE-2021-30797, CVE-2021-30799). Processing maliciously crafted web content may lead to universal cross site scripting (CVE-2021-30689, CVE-2021-30744). A malicious website may be able to access restricted ports on arbitrary servers (CVE-2021-30720).

References: https://advisories.mageia.org/MGASA-2021-0400.html, https://bugs.mageia.org/show_bug.cgi?id=29282, https://webkitgtk.org/2021/07/09/webkitgtk2.32.2-released.html, https://webkitgtk.org/2021/07/23/webkitgtk2.32.3-released.html, https://webkitgtk.org/security/WSA-2021-0004.html