openSUSE 15.4/15.5 Critical: Arbitrary Code Execution in webkit2gtk3
opensuse
January 2, 2024
This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033).
Description
This update for webkit2gtk3 fixes the following issues:
* CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary
code execution (bsc#1218033).
* CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-
service (bsc#1218032).
* CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit
GStreamer-based ports (bsc#1215870).
* CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1218032,
bsc#1215868).
Patch
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* Basesystem Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2024-4=1
* Basesystem Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-4=1
* Desktop Applications Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2024-4=1
* Desktop Applications Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-4=1
* Development Tools Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-4=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-4=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-4=1
* SUSE Linux Enterprise Real Time 15 SP4
zypper in -t patch...
Read the Full AdvisoryPackage List
* Basesystem Module 15-SP4 (noarch)
* WebKitGTK-4.0-lang-2.42.4-150400.4.70.3
* Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* typelib-1_0-JavaScriptCore-4_0-2.42.4-150400.4.70.3
* webkit2gtk-4_0-injected-bundles-debuginfo-2.42.4-150400.4.70.3
* typelib-1_0-WebKit2WebExtension-4_0-2.42.4-150400.4.70.3
* webkit2gtk-4_0-injected-bundles-2.42.4-150400.4.70.3
* libwebkit2gtk-4_0-37-debuginfo-2.42.4-150400.4.70.3
* typelib-1_0-WebKit2-4_0-2.42.4-150400.4.70.3
* webkit2gtk3-soup2-devel-2.42.4-150400.4.70.3
* libwebkit2gtk-4_0-37-2.42.4-150400.4.70.3
* libjavascriptcoregtk-4_0-18-debuginfo-2.42.4-150400.4.70.3
* webkit2gtk3-soup2-debugsource-2.42.4-150400.4.70.3
* libjavascriptcoregtk-4_0-18-2.42.4-150400.4.70.3
* Basesystem Module 15-SP5 (noarch)
* WebKitGTK-4.0-lang-2.42.4-150400.4.70.3
* Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* typelib-1_0-JavaScriptCore-4_0-2.42.4-150400.4.70.3
* webkit2gtk-4_0-injected-bundles-debuginfo-2.42.4-150400.4.70.3
*...
Read the Full AdvisoryReferences
* bsc#1215868
* bsc#1215869
* bsc#1215870
* bsc#1218032
* bsc#1218033
## References:
* https://www.suse.com/security/cve/CVE-2023-32359.html
* https://www.suse.com/security/cve/CVE-2023-39928.html
* https://www.suse.com/security/cve/CVE-2023-40451.html
* https://www.suse.com/security/cve/CVE-2023-41074.html
* https://www.suse.com/security/cve/CVE-2023-42883.html
* https://www.suse.com/security/cve/CVE-2023-42890.html
* https://bugzilla.suse.com/show_bug.cgi?id=1215868
* https://bugzilla.suse.com/show_bug.cgi?id=1215869
* https://bugzilla.suse.com/show_bug.cgi?id=1215870
* https://bugzilla.suse.com/show_bug.cgi?id=1218032
* https://bugzilla.suse.com/show_bug.cgi?id=1218033
PREVIOUS 
NEXT Severity
critical
Lowest
Low
Medium
High
Critical
Announcement ID: SUSE-SU-2024:0004-1
Rating: important
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!