Most recent entries from all

ALSA-2024:9144 — Important: webkit2gtk3 security update

Affected: AlmaLinux:9: webkit2gtk3, AlmaLinux:9: webkit2gtk3-devel, AlmaLinux:9: webkit2gtk3-jsc, AlmaLinux:9: webkit2gtk3-jsc-devel

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* webkit: visiting a malicious website may lead to address bar spoofing (CVE-2023-42843) * webkit: heap use-after-free may lead to arbitrary code execution (CVE-2023-42950) * webkit: processing malicious web content may lead to a denial of service (CVE-2023-42956) * chromium-browser: Use after free in ANGLE (CVE-2024-4558)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2024-02479

BIT-java-2023-42950

Affected: Bitnami: java

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2. Processing maliciously crafted web content may lead to arbitrary code execution.

certfr-2024-avi-0883 — De multiples vulnérabilités ont été découvertes dans Oracle Java SE. Certaines d'entre elles permettent à un attaquant…

certfr-2024-avi-0883

EUVD-2026-258465

fkie_cve-2023-42950

GHSA-6cvp-282g-6jp8

gsd-2023-42950

OESA-2024-2485 — openjdk-latest security update

Affected: openEuler:22.03-LTS-SP3: openjdk-latest

The OpenJDK runtime environment. Security Fix(es): Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2020-14556) Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized abi…

RHSA-2024:9144 — Red Hat Security Advisory: webkit2gtk3 security update

webkit: visiting a malicious website may lead to address bar spoofing webkit: heap use-after-free may lead to arbitrary code execution webkit: processing malicious web content may lead to a denial of service webkitgtk: Processing maliciously crafted web content may lead to memory corruption chromium-browser: Use after free in ANGLE

RHSA-2025:10364 — Red Hat Security Advisory: webkitgtk4 security update

webkitgtk: Processing a file may lead to a denial of service or potentially disclose memory contents webkitgtk: Logic issue may lead to arbitrary code execution webkitgtk: Memory corruption may lead to arbitrary code execution webkitgtk: Logic issue may lead to cross site scripting webkitgtk: Memory corruption may lead to arbitrary code execution webkitgtk: Memory corruption may lead to arbitrary code execution webkitgtk: Input validation issue may lead to cross site scripting webkitgtk: Logic issue may lead to arbitrary code execution webkitgtk: Command injection in web inspector webkitgtk: Use-after-free may lead to application termination or arbitrary code execution webkitgtk: Out-of-bounds read may lead to unexpected application termination or arbitrary code execution webkitgtk: Use-after-free may lead to application termination or arbitrary code execution webkitgtk: Access issue in content security policy webkitgtk: A logic issue may lead to cross site scripting webkitgtk: use after free issue may lead to arbitrary code execution webkitgtk: type confusion may lead to arbitrary code execution webkitgtk: use-after-free may lead to arbitrary code execution webkitgtk: input validation issue may lead to a cross site scripting webkitgtk: out-of-bounds write may lead to code execution webkitgtk: use-after-free may lead to arbitrary code execution webkitgtk: Use-after-free in AudioSourceProviderGStreamer leading to arbitrary code execution webkitgtk: use-after-free may lead to…

SUSE-SU-2024:1269-1 — Security update for webkit2gtk3

Security update for webkit2gtk3

UBUNTU-CVE-2023-42950

Affected: Ubuntu:16.04:LTS: qtwebkit-source, Ubuntu:16.04:LTS: webkitgtk, Ubuntu:16.04:LTS: qtwebkit-opensource-src, Ubuntu:16.04:LTS: webkit2gtk, Ubuntu:18.04:LTS: webkit2gtk, Ubuntu:18.04:LTS: qtwebkit-opensource-src, Ubuntu:18.04:LTS: qtwebkit-source, Ubuntu:18.04:LTS: webkitgtk, Ubuntu:20.04:LTS: webkit2gtk, Ubuntu:20.04:LTS: qtwebkit-opensource-src and 5 more

WID-SEC-W-2023-3094 — Apple macOS: Mehrere Schwachstellen

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.