===========================================================================
ZMCIRT Vulnerability Bulletin
ZMC-2022.04.04.0800
webkit2gtk3: CVSS (Max): 8.8
4th March 2022
===========================================================================
Product: webkit2gtk3
Publisher: SUSE
Operating System: SUSE
Resolution: Patch/Upgrade
CVE Names: CVE-2022-22594 CVE-2022-22592 CVE-2022-22590
CVE-2022-22589 CVE-2021-45483 CVE-2021-45482
CVE-2021-45481 CVE-2021-30984 CVE-2021-30954
CVE-2021-30953 CVE-2021-30952 CVE-2021-30951
CVE-2021-30936 CVE-2021-30934 CVE-2021-30889
Original Bulletin:
https://www.suse.com/support/update/announcement/2022/suse-su-20220690-1
Comment: CVSS (Max): 8.8 CVE-2022-22590 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for webkit2gtk3
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:0690-1
Rating: important
References: #1195064 #1195735
Cross-References: CVE-2021-30934 CVE-2021-30936 CVE-2021-30951 CVE-2021-30952
CVE-2021-30953 CVE-2021-30954 CVE-2021-30984 CVE-2021-45481
CVE-2021-45482 CVE-2021-45483 CVE-2022-22589 CVE-2022-22590
CVE-2022-22592 CVE-2022-22594
Affected Products:
HPE Helion Openstack 8
SUSE Linux Enterprise Server 12-SP2-BCL
SUSE Linux Enterprise Server 12-SP3-BCL
SUSE Linux Enterprise Server 12-SP3-LTSS
SUSE Linux Enterprise Server 12-SP4-LTSS
SUSE Linux Enterprise Server 12-SP5
SUSE Linux Enterprise Server for SAP 12-SP3
SUSE Linux Enterprise Server for SAP 12-SP4
SUSE Linux Enterprise Server for SAP Applications 12-SP5
SUSE Linux Enterprise Software Development Kit 12-SP5
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud 9
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud Crowbar 9
______________________________________________________________________________
An update that fixes 14 vulnerabilities is now available.
Description:
This update for webkit2gtk3 fixes the following issues:
Update to version 2.34.5 (bsc#1195735):
o CVE-2022-22589: A validation issue was addressed with improved input
sanitization.
o CVE-2022-22590: A use after free issue was addressed with improved memory
management.
o CVE-2022-22592: A logic issue was addressed with improved state management.
Update to version 2.34.4 (bsc#1195064):
o CVE-2021-30934: A buffer overflow issue was addressed with improved memory
handling.
o CVE-2021-30936: A use after free issue was addressed with improved memory
management.
o CVE-2021-30951: A use after free issue was addressed with improved memory
management.
o CVE-2021-30952: An integer overflow was addressed with improved input
validation.
o CVE-2021-30953: An out-of-bounds read was addressed with improved bounds
checking.
o CVE-2021-30954: A type confusion issue was addressed with improved memory
handling.
o CVE-2021-30984: A race condition was addressed with improved state
handling.
o CVE-2022-22594: A cross-origin issue in the IndexDB API was addressed with
improved input validation.
The following CVEs were addressed in a previous update:
o CVE-2021-45481: Incorrect memory allocation in
WebCore::ImageBufferCairoImageSurfaceBackend::create.
o CVE-2021-45482: A use-after-free in WebCore::ContainerNode::firstChild.
o CVE-2021-45483: A use-after-free in WebCore::Frame::page.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE OpenStack Cloud Crowbar 9:
zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-690=1
o SUSE OpenStack Cloud Crowbar 8:
zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2022-690=1
o SUSE OpenStack Cloud 9:
zypper in -t patch SUSE-OpenStack-Cloud-9-2022-690=1
o SUSE OpenStack Cloud 8:
zypper in -t patch SUSE-OpenStack-Cloud-8-2022-690=1
o SUSE Linux Enterprise Software Development Kit 12-SP5:
zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-690=1
o SUSE Linux Enterprise Server for SAP 12-SP4:
zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-690=1
o SUSE Linux Enterprise Server for SAP 12-SP3:
zypper in -t patch SUSE-SLE-SAP-12-SP3-2022-690=1
o SUSE Linux Enterprise Server 12-SP5:
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-690=1
o SUSE Linux Enterprise Server 12-SP4-LTSS:
zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-690=1
o SUSE Linux Enterprise Server 12-SP3-LTSS:
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2022-690=1
o SUSE Linux Enterprise Server 12-SP3-BCL:
zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-690=1
o SUSE Linux Enterprise Server 12-SP2-BCL:
zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-690=1
o HPE Helion Openstack 8:
zypper in -t patch HPE-Helion-OpenStack-8-2022-690=1
Package List:
o SUSE OpenStack Cloud Crowbar 9 (x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE OpenStack Cloud Crowbar 9 (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE OpenStack Cloud Crowbar 8 (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE OpenStack Cloud Crowbar 8 (x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE OpenStack Cloud 9 (x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE OpenStack Cloud 9 (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE OpenStack Cloud 8 (x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE OpenStack Cloud 8 (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le
s390x x86_64):
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
webkit2gtk3-devel-2.34.5-2.85.3
o SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE Linux Enterprise Server for SAP 12-SP4 (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE Linux Enterprise Server for SAP 12-SP3 (ppc64le x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE Linux Enterprise Server for SAP 12-SP3 (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP5 (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP4-LTSS (aarch64 ppc64le s390x x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP4-LTSS (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP3-LTSS (aarch64 ppc64le s390x x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP3-LTSS (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP3-BCL (x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP2-BCL (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
o SUSE Linux Enterprise Server 12-SP2-BCL (x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
webkit2gtk3-devel-2.34.5-2.85.3
o HPE Helion Openstack 8 (x86_64):
libjavascriptcoregtk-4_0-18-2.34.5-2.85.3
libjavascriptcoregtk-4_0-18-debuginfo-2.34.5-2.85.3
libwebkit2gtk-4_0-37-2.34.5-2.85.3
libwebkit2gtk-4_0-37-debuginfo-2.34.5-2.85.3
typelib-1_0-JavaScriptCore-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2-4_0-2.34.5-2.85.3
typelib-1_0-WebKit2WebExtension-4_0-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-2.34.5-2.85.3
webkit2gtk-4_0-injected-bundles-debuginfo-2.34.5-2.85.3
webkit2gtk3-debugsource-2.34.5-2.85.3
o HPE Helion Openstack 8 (noarch):
libwebkit2gtk3-lang-2.34.5-2.85.3
References:
o https://www.suse.com/security/cve/CVE-2021-30934.html
o https://www.suse.com/security/cve/CVE-2021-30936.html
o https://www.suse.com/security/cve/CVE-2021-30951.html
o https://www.suse.com/security/cve/CVE-2021-30952.html
o https://www.suse.com/security/cve/CVE-2021-30953.html
o https://www.suse.com/security/cve/CVE-2021-30954.html
o https://www.suse.com/security/cve/CVE-2021-30984.html
o https://www.suse.com/security/cve/CVE-2021-45481.html
o https://www.suse.com/security/cve/CVE-2021-45482.html
o https://www.suse.com/security/cve/CVE-2021-45483.html
o https://www.suse.com/security/cve/CVE-2022-22589.html
o https://www.suse.com/security/cve/CVE-2022-22590.html
o https://www.suse.com/security/cve/CVE-2022-22592.html
o https://www.suse.com/security/cve/CVE-2022-22594.html
o https://bugzilla.suse.com/1195064
o https://bugzilla.suse.com/1195735
- --------------------------END INCLUDED TEXT--------------------
ZMCIRT has made every effort to ensure that the informaqtion contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. ZMCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Internet Email: report@cirt.zm
Telephone: 7070
ZMCIRT personnel answer during Zambian business hours
which are 8am to 5pm.
On call after hours for member emergencies only.
===========================================================================
Copyright @2023 ZAMBIA CIRT