CVE-2021-30720

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers.

GNOME is the default desktop environment of Rocky Linux.

The following packages have been upgraded to a later upstream version: gdm (40.0), webkit2gtk3 (2.32.3). (BZ#1909300)

Security Fix(es):

• webkitgtk: Use-after-free in AudioSourceProviderGStreamer leading to arbitrary code execution (CVE-2020-13558)

• LibRaw: Stack buffer overflow in LibRaw::identify_process_dng_fields() in identify.cpp (CVE-2020-24870)

• webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2020-27918)

• webkitgtk: IFrame sandboxing policy violation (CVE-2021-1765)

• webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-1788)

• webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-1789)

• webkitgtk: Access to restricted ports on arbitrary servers via port redirection (CVE-2021-1799)

• webkitgtk: IFrame sandboxing policy violation (CVE-2021-1801)

• webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-1844)

• webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1870)

• webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1871)

• webkitgtk: Use-after-free in ImageLoader dispatchPendingErrorEvent leading to information leak and possibly code execution (CVE-2021-21775)

• webkitgtk: Use-after-free in WebCore::GraphicsContext leading to information leak and possibly code execution (CVE-2021-21779)

• webkitgtk: Use-after-free in fireEventListeners leading to arbitrary code execution (CVE-2021-21806)

• webkitgtk: Integer overflow leading to arbitrary code execution (CVE-2021-30663)

• webkitgtk: Memory corruption leading to arbitrary code execution (CVE-2021-30665)

• webkitgtk: Logic issue leading to leak of sensitive user information (CVE-2021-30682)

• webkitgtk: Logic issue leading to universal cross site scripting attack (CVE-2021-30689)

• webkitgtk: Logic issue allowing access to restricted ports on arbitrary servers (CVE-2021-30720)

• webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30734)

• webkitgtk: Cross-origin issue with iframe elements leading to universal cross site scripting attack (CVE-2021-30744)

• webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30749)

• webkitgtk: Type confusion leading to arbitrary code execution (CVE-2021-30758)

• webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30795)

• webkitgtk: Insufficient checks leading to arbitrary code execution (CVE-2021-30797)

• webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30799)

• webkitgtk: User may be unable to fully delete browsing history (CVE-2020-29623)

• gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (CVE-2020-36241)

• gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (incomplete CVE-2020-36241 fix) (CVE-2021-28650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers.

GNOME is the default desktop environment of AlmaLinux.

The following packages have been upgraded to a later upstream version: gdm (40.0), webkit2gtk3 (2.32.3). (BZ#1909300)

Security Fix(es):

• webkitgtk: Use-after-free in AudioSourceProviderGStreamer leading to arbitrary code execution (CVE-2020-13558)

• LibRaw: Stack buffer overflow in LibRaw::identify_process_dng_fields() in identify.cpp (CVE-2020-24870)

• webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2020-27918)

• webkitgtk: IFrame sandboxing policy violation (CVE-2021-1765)

• webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-1788)

• webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-1789)

• webkitgtk: Access to restricted ports on arbitrary servers via port redirection (CVE-2021-1799)

• webkitgtk: IFrame sandboxing policy violation (CVE-2021-1801)

• webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-1844)

• webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1870)

• webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1871)

• webkitgtk: Use-after-free in ImageLoader dispatchPendingErrorEvent leading to information leak and possibly code execution (CVE-2021-21775)

• webkitgtk: Use-after-free in WebCore::GraphicsContext leading to information leak and possibly code execution (CVE-2021-21779)

• webkitgtk: Use-after-free in fireEventListeners leading to arbitrary code execution (CVE-2021-21806)

• webkitgtk: Integer overflow leading to arbitrary code execution (CVE-2021-30663)

• webkitgtk: Memory corruption leading to arbitrary code execution (CVE-2021-30665)

• webkitgtk: Logic issue leading to leak of sensitive user information (CVE-2021-30682)

• webkitgtk: Logic issue leading to universal cross site scripting attack (CVE-2021-30689)

• webkitgtk: Logic issue allowing access to restricted ports on arbitrary servers (CVE-2021-30720)

• webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30734)

• webkitgtk: Cross-origin issue with iframe elements leading to universal cross site scripting attack (CVE-2021-30744)

• webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30749)

• webkitgtk: Type confusion leading to arbitrary code execution (CVE-2021-30758)

• webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30795)

• webkitgtk: Insufficient checks leading to arbitrary code execution (CVE-2021-30797)

• webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30799)

• webkitgtk: User may be unable to fully delete browsing history (CVE-2020-29623)

• gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (CVE-2020-36241)

• gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (incomplete CVE-2020-36241 fix) (CVE-2021-28650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Updated webkit2 packages fix security vulnerabilities:

A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage (CVE-2021-21775).

A use-after-free vulnerability exists in the way Webkit GraphicsContext handles certain events in WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability (CVE-2021-21779).

Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2021-30663, CVE-2021-30665, CVE-2021-30734, CVE-2021-30749, CVE-2021-30758, CVE-2021-30795, CVE-2021-30797, CVE-2021-30799).

Processing maliciously crafted web content may lead to universal cross site scripting (CVE-2021-30689, CVE-2021-30744).

A malicious website may be able to access restricted ports on arbitrary servers (CVE-2021-30720).

This update for webkit2gtk3 fixes the following issues:

• Update to version 2.32.3:
• CVE-2021-21775: Fixed a use-after-free vulnerability in the way certain events are processed for ImageLoader objects. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-21779: Fixed a use-after-free vulnerability in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-30663: An integer overflow was addressed with improved input validation. (bsc#1188697)
• CVE-2021-30665: A memory corruption issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30689: A logic issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30720: A logic issue was addressed with improved restrictions. (bsc#1188697)
• CVE-2021-30734: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30744: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. (bsc#1188697)
• CVE-2021-30749: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30758: A type confusion issue was addressed with improved state handling. (bsc#1188697)
• CVE-2021-30795: A use after free issue was addressed with improved memory management. (bsc#1188697)
• CVE-2021-30797: This issue was addressed with improved checks. (bsc#1188697)
• CVE-2021-30799: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for webkit2gtk3 fixes the following issues:

• Update to version 2.32.3:
• CVE-2021-21775: Fixed a use-after-free vulnerability in the way certain events are processed for ImageLoader objects. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-21779: Fixed a use-after-free vulnerability in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-30663: An integer overflow was addressed with improved input validation. (bsc#1188697)
• CVE-2021-30665: A memory corruption issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30689: A logic issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30720: A logic issue was addressed with improved restrictions. (bsc#1188697)
• CVE-2021-30734: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30744: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. (bsc#1188697)
• CVE-2021-30749: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30758: A type confusion issue was addressed with improved state handling. (bsc#1188697)
• CVE-2021-30795: A use after free issue was addressed with improved memory management. (bsc#1188697)
• CVE-2021-30797: This issue was addressed with improved checks. (bsc#1188697)
• CVE-2021-30799: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)

This update for webkit2gtk3 fixes the following issues:

• Update to version 2.32.3:
• CVE-2021-21775: Fixed a use-after-free vulnerability in the way certain events are processed for ImageLoader objects. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-21779: Fixed a use-after-free vulnerability in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-30663: An integer overflow was addressed with improved input validation. (bsc#1188697)
• CVE-2021-30665: A memory corruption issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30689: A logic issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30720: A logic issue was addressed with improved restrictions. (bsc#1188697)
• CVE-2021-30734: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30744: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. (bsc#1188697)
• CVE-2021-30749: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30758: A type confusion issue was addressed with improved state handling. (bsc#1188697)
• CVE-2021-30795: A use after free issue was addressed with improved memory management. (bsc#1188697)
• CVE-2021-30797: This issue was addressed with improved checks. (bsc#1188697)
• CVE-2021-30799: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)

This update for webkit2gtk3 fixes the following issues:

Update to version 2.32.3:

• CVE-2021-21775: Fixed a use-after-free vulnerability in the way certain events are processed for ImageLoader objects. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-21779: Fixed a use-after-free vulnerability in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-30663: An integer overflow was addressed with improved input validation. (bsc#1188697)
• CVE-2021-30665: A memory corruption issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30689: A logic issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30720: A logic issue was addressed with improved restrictions. (bsc#1188697)
• CVE-2021-30734: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30744: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. (bsc#1188697)
• CVE-2021-30749: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30758: A type confusion issue was addressed with improved state handling. (bsc#1188697)
• CVE-2021-30795: A use after free issue was addressed with improved memory management. (bsc#1188697)
• CVE-2021-30797: This issue was addressed with improved checks. (bsc#1188697)
• CVE-2021-30799: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)

This update for webkit2gtk3 fixes the following issues:

• Update to version 2.32.3:
• CVE-2021-21775: Fixed a use-after-free vulnerability in the way certain events are processed for ImageLoader objects. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-21779: Fixed a use-after-free vulnerability in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697)
• CVE-2021-30663: An integer overflow was addressed with improved input validation. (bsc#1188697)
• CVE-2021-30665: A memory corruption issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30689: A logic issue was addressed with improved state management. (bsc#1188697)
• CVE-2021-30720: A logic issue was addressed with improved restrictions. (bsc#1188697)
• CVE-2021-30734: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30744: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. (bsc#1188697)
• CVE-2021-30749: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)
• CVE-2021-30758: A type confusion issue was addressed with improved state handling. (bsc#1188697)
• CVE-2021-30795: A use after free issue was addressed with improved memory management. (bsc#1188697)
• CVE-2021-30797: This issue was addressed with improved checks. (bsc#1188697)
• CVE-2021-30799: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697)

A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.