Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Debian 11: DLA-3982-1 critical: webkit2gtk code execution and XSS threats

debian lts
Calendar Grey December 3, 2024
Scroller Debian Lts
Security Notice DLA-3982-1 highlights significant vulnerabilities in webkit2gtk for Debian LTS. Immediate upgrade recommended for safety.
The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2024-44308
Topics%20covered

Topics Covered

security advisory debian cross site scripting arbitrary code execution code exploit webkitgtk web engine

Summary

CVE-2024-44308

Clement Lecigne and Benoit Sevens discovered that processing
maliciously crafted web content may lead to arbitrary code
execution. Apple is aware of a report that this issue may have
been actively exploited on Intel-based Mac systems.

CVE-2024-44309

Clement Lecigne and Benoit Sevens discovered that processing
maliciously crafted web content may lead to a cross site scripting
attack. Apple is aware of a report that this issue may have been
actively exploited on Intel-based Mac systems.

For Debian 11 bullseye, these problems have been fixed in version
2.46.4-1~deb11u1.

We recommend that you upgrade your webkit2gtk packages.

For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/webkit2gtk

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: webkit2gtk
Version: 2.46.4-1~deb11u1
CVE ID: CVE-2024-44308 CVE-2024-44309

Topics%20covered

Topics Covered

security advisory debian cross site scripting arbitrary code execution code exploit webkitgtk web engine

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.