SUSE-SU-2024:1293-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2024/suse-su-20241293-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1293-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2024:1293-1
Upstream
CVE (8)
Related
CVE (8)
Published
2024-04-15T14:48:15Z
Modified
2026-03-11T07:26:22Z
Summary
Security update for webkit2gtk3
Details

webkit2gtk3 was updated to fix the following issues:

Update to version 2.44.0 (boo#1222010):

  • CVE-2024-23252:

    Credit to anbu1024 of SecANT. Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.

  • CVE-2024-23254:

    Credit to James Lee (@Windowsrcer). Impact: A malicious website may exfiltrate audio data cross-origin. Description: The issue was addressed with improved UI handling.

  • CVE-2024-23263:

    Credit to Johan Carlsson (joaxcar). Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved validation.

  • CVE-2024-23280:

    Credit to An anonymous researcher. Impact: A maliciously crafted webpage may be able to fingerprint the user. Description: An injection issue was addressed with improved validation.

  • CVE-2024-23284:

    Credit to Georg Felber and Marco Squarcina. Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved state management.

  • CVE-2023-42950:

    Credit to Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute and rushikesh nandedkar. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.

  • CVE-2023-42956:

    Credit to SungKwon Lee (Demon.Team). Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.

  • CVE-2023-42843:

    Credit to Kacper Kwapisz (@KKKas_). Impact: Visiting a malicious website may lead to address bar spoofing. Description: An inconsistent user interface issue was addressed with improved state management.

  • Make the DOM accessibility tree reachable from UI process with GTK4.
  • Removed the X11 and WPE renderers in favor of DMA-BUF.
  • Improved vblank synchronization when rendering.
  • Removed key event reinjection in GTK4 to make keyboard shortcuts work in web sites.
  • Fix gamepads detection by correctly handling focused window in GTK4.
  • Use WebAssembly on aarch64. It is the upstream default and no longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON, -DENABLE_WEBASSEMBLY=OFF and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
References

Affected packages

SUSE:Linux Enterprise Server 12 SP5
webkit2gtk3

Package

Name
webkit2gtk3
Purl
pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.44.0-4.3.2

Ecosystem specific 

{
    "binaries":  [
        {
            "libjavascriptcoregtk-4_0-18":  "2.44.0-4.3.2",
            "libwebkit2gtk-4_0-37":  "2.44.0-4.3.2",
            "libwebkit2gtk3-lang":  "2.44.0-4.3.2",
            "typelib-1_0-JavaScriptCore-4_0":  "2.44.0-4.3.2",
            "typelib-1_0-WebKit2-4_0":  "2.44.0-4.3.2",
            "typelib-1_0-WebKit2WebExtension-4_0":  "2.44.0-4.3.2",
            "webkit2gtk-4_0-injected-bundles":  "2.44.0-4.3.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1293-1.json"
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
webkit2gtk3

Package

Name
webkit2gtk3
Purl
pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.44.0-4.3.2

Ecosystem specific 

{
    "binaries":  [
        {
            "libjavascriptcoregtk-4_0-18":  "2.44.0-4.3.2",
            "libwebkit2gtk-4_0-37":  "2.44.0-4.3.2",
            "libwebkit2gtk3-lang":  "2.44.0-4.3.2",
            "typelib-1_0-JavaScriptCore-4_0":  "2.44.0-4.3.2",
            "typelib-1_0-WebKit2-4_0":  "2.44.0-4.3.2",
            "typelib-1_0-WebKit2WebExtension-4_0":  "2.44.0-4.3.2",
            "webkit2gtk-4_0-injected-bundles":  "2.44.0-4.3.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1293-1.json"
SUSE:Linux Enterprise Software Development Kit 12 SP5
webkit2gtk3

Package

Name
webkit2gtk3
Purl
pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.44.0-4.3.2

Ecosystem specific 

{
    "binaries":  [
        {
            "typelib-1_0-WebKit2WebExtension-4_0":  "2.44.0-4.3.2",
            "webkit2gtk3-devel":  "2.44.0-4.3.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1293-1.json"
SUSE:Linux Enterprise Workstation Extension 12 SP5
webkit2gtk3

Package

Name
webkit2gtk3
Purl
pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.44.0-4.3.2

Ecosystem specific 

{
    "binaries":  [
        {
            "libjavascriptcoregtk-4_0-18-32bit":  "2.44.0-4.3.2"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:1293-1.json"