Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

SUSE: 2023:39928 critical: webkit2gtk code execution and Denial of Service

suse
Calendar Grey January 2, 2024
Dist Suse Esm H88
An important enhancement for webkit2gtk3 fixes security flaws that could potentially enable unauthorized code execution and disrupt services.
* bsc#1215868 * bsc#1215869 * bsc#1215870 * bsc#1218032 * bsc#1218033

Summary

## This update for webkit2gtk3 fixes the following issues: * CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). * CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of- service (bsc#1218032). * CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). * CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1218032, bsc#1215868). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2024-4=1 * Basesystem Module 15-SP5

Topics%20covered

Topics Covered

security advisory code execution critical update deny service SUSE Linux Enterprise Server webkit update

References

* bsc#1215868

* bsc#1215869

* bsc#1215870

* bsc#1218032

* bsc#1218033

Cross-

* CVE-2023-32359

* CVE-2023-39928

* CVE-2023-40451

* CVE-2023-41074

* CVE-2023-42883

* CVE-2023-42890

CVSS scores:

* CVE-2023-32359 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

* CVE-2023-32359 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

* CVE-2023-39928 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-39928 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-40451 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-40451 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2023-41074 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:0004-1
Rating: important

Topics%20covered

Topics Covered

security advisory code execution critical update deny service SUSE Linux Enterprise Server webkit update

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here