Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

SUSE: 2023:4978-1 important: webkit2gtk3 DoS and code execution risks

suse
Calendar Grey December 27, 2023
Dist Suse Esm H88
Urgent security update issued for webkit2gtk3 to address major flaws affecting SUSE Linux distributions.
* bsc#1215868 * bsc#1215869 * bsc#1215870 * bsc#1218032 * bsc#1218033

Summary

## This update for webkit2gtk3 fixes the following issues: * CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). * CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of- service (bsc#1218032). * CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). * CVE-2023-39928: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215868). * CVE-2023-40451: Update to version 2.42.4 (bsc#1215869). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:

Topics%20covered

Topics Covered

security advisory software update code execution Denial of Service SUSE Webkit2gtk3

References

* bsc#1215868

* bsc#1215869

* bsc#1215870

* bsc#1218032

* bsc#1218033

Cross-

* CVE-2023-39928

* CVE-2023-40451

* CVE-2023-41074

* CVE-2023-42883

* CVE-2023-42890

CVSS scores:

* CVE-2023-39928 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-39928 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-40451 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-40451 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-41074 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-41074 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-42883 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2023-42883 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2023:4978-1
Rating: important

Topics%20covered

Topics Covered

security advisory software update code execution Denial of Service SUSE Webkit2gtk3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here