CVE-2024-23254

The issue was addressed with improved UI handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. A malicious website may exfiltrate audio data cross-origin.

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

• webkitgtk: data isolation bypass vulnerability (CVE-2024-44309)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Due to issues in our build system this package is very outdated, now that the issues are fixed we are publishing the current upstream version. Lot of CVEs are fixed and a lot of changes were made by upstream, see the links.

This update for webkit2gtk3 fixes the following issues:

• CVE-2024-23252: Fixed denial of service via crafted web content (bsc#1222010).
• CVE-2024-23254: Fixed possible audio data exilftration cross-origin via malicious website (bsc#1222010).
• CVE-2024-23263: Fixed lack of Content Security Policy enforcing via malicious crafted web content (bsc#1222010).
• CVE-2024-23280: Fixed possible user fingeprint via malicious crafted web content (bsc#1222010).
• CVE-2024-23284: Fixed lack of Content Security Policy enforcing via malicious crafted web content (bsc#1222010).
• CVE-2023-42950: Fixed arbitrary code execution via crafted web content (bsc#1222010).
• CVE-2023-42956: Fixed denial of service via crafted web content (bsc#1222010).
• CVE-2023-42843: Fixed address bar spoofing via malicious website (bsc#1222010).

Other fixes:

• Update to version 2.44.0 (bsc#1222010):
  • Make the DOM accessibility tree reachable from UI process with
    GTK4.
  • Removed the X11 and WPE renderers in favor of DMA-BUF.
  • Improved vblank synchronization when rendering.
  • Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  • Fix gamepads detection by correctly handling focused window in
    GTK4.

This update for webkit2gtk3 fixes the following issues:

• CVE-2024-23252: Fixed denial of service via crafted web content (bsc#1222010).
• CVE-2024-23254: Fixed possible audio data exilftration cross-origin via malicious website (bsc#1222010).
• CVE-2024-23263: Fixed lack of Content Security Policy enforcing via malicious crafted web content (bsc#1222010).
• CVE-2024-23280: Fixed possible user fingeprint via malicious crafted web content (bsc#1222010).
• CVE-2024-23284: Fixed lack of Content Security Policy enforcing via malicious crafted web content (bsc#1222010).
• CVE-2023-42950: Fixed arbitrary code execution via crafted web content (bsc#1222010).
• CVE-2023-42956: Fixed denial of service via crafted web content (bsc#1222010).
• CVE-2023-42843: Fixed address bar spoofing via malicious website (bsc#1222010).

Other fixes:

• Update to version 2.44.0 (bsc#1222010):
  • Make the DOM accessibility tree reachable from UI process with
    GTK4.
  • Removed the X11 and WPE renderers in favor of DMA-BUF.
  • Improved vblank synchronization when rendering.
  • Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  • Fix gamepads detection by correctly handling focused window in
    GTK4.

webkit2gtk3 was updated to fix the following issues:

Update to version 2.44.0 (boo#1222010):

• CVE-2024-23252:

  Credit to anbu1024 of SecANT. Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.

• CVE-2024-23254:

  Credit to James Lee (@Windowsrcer). Impact: A malicious website may exfiltrate audio data cross-origin. Description: The issue was addressed with improved UI handling.

• CVE-2024-23263:

  Credit to Johan Carlsson (joaxcar). Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved validation.

• CVE-2024-23280:

  Credit to An anonymous researcher. Impact: A maliciously crafted webpage may be able to fingerprint the user. Description: An injection issue was addressed with improved validation.

• CVE-2024-23284:

  Credit to Georg Felber and Marco Squarcina. Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A logic issue was addressed with improved state management.

• CVE-2023-42950:

  Credit to Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute and rushikesh nandedkar. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.

• CVE-2023-42956:

  Credit to SungKwon Lee (Demon.Team). Impact: Processing web content may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.

• CVE-2023-42843:

  Credit to Kacper Kwapisz (@KKKas_). Impact: Visiting a malicious website may lead to address bar spoofing. Description: An inconsistent user interface issue was addressed with improved state management.

• Make the DOM accessibility tree reachable from UI process with GTK4.
• Removed the X11 and WPE renderers in favor of DMA-BUF.
• Improved vblank synchronization when rendering.
• Removed key event reinjection in GTK4 to make keyboard shortcuts work in web sites.
• Fix gamepads detection by correctly handling focused window in GTK4.

• Use WebAssembly on aarch64. It is the upstream default and no longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON, -DENABLE_WEBASSEMBLY=OFF and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.

This update for webkit2gtk3 fixes the following issues:

• Update to version 2.44.2 (bsc#1225071):
• CVE-2024-23252: Fixed a vulnerability where processed web content may lead to a denial-of-service. (bsc#1222010)
• CVE-2024-23254: Fixed a vulnerability where a malicious website may exfiltrate audio data cross-origin. (bsc#1222010)
• CVE-2024-23263: Fixed a vulnerability where processed maliciously crafted web content may prevent Content Security Policy from being enforced. (bsc#1222010)
• CVE-2024-23280: Fixed a vulnerability where a maliciously crafted webpage may be able to fingerprint the user. (bsc#1222010)
• CVE-2024-23284: Fixed a vulnerability where processed maliciously crafted web content may prevent Content Security Policy from being enforced. (bsc#1222010)
• CVE-2023-42950: Fixed a vulnerability where processed maliciously crafted web content may lead to arbitrary code execution. (bsc#1222010)
• CVE-2023-42956: Fixed a vulnerability where processed web content may lead to a denial-of-service. (bsc#1222010)
• CVE-2023-42843: Fixed a vulnerability where visiting a malicious website may lead to address bar spoofing. (bsc#1222010)
• CVE-2024-27834: Fixed a vulnerability where an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. (bsc#1225071)

This update for webkit2gtk3 fixes the following issues:

• Update to version 2.44.2 (bsc#1225071)
• CVE-2024-27834: Fixed a vulnerability where an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. (bsc#1225071)

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.