CVE-2020-13543

A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

GNOME is the default desktop environment of Rocky Linux.

The following packages have been upgraded to a later upstream version: accountsservice (0.6.55), webkit2gtk3 (2.30.4). (BZ#1846376, BZ#1883304)

Security Fix(es):

• webkitgtk: type confusion may lead to arbitrary code execution (CVE-2020-9948)

• webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-9951)

• webkitgtk: out-of-bounds write may lead to code execution (CVE-2020-9983)

• webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-13543)

• webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-13584)

• glib2: insecure permissions for files and directories (CVE-2019-13012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

GNOME is the default desktop environment of AlmaLinux.

The following packages have been upgraded to a later upstream version: accountsservice (0.6.55), webkit2gtk3 (2.30.4). (BZ#1846376, BZ#1883304)

Security Fix(es):

• webkitgtk: type confusion may lead to arbitrary code execution (CVE-2020-9948)

• webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-9951)

• webkitgtk: out-of-bounds write may lead to code execution (CVE-2020-9983)

• webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-13543)

• webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-13584)

• glib2: insecure permissions for files and directories (CVE-2019-13012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The webkit2 package has been updated to version 2.30.3, fixing several security issues and other bugs.

A type confusion issue may lead to arbitrary code execution with a maliciously crafted web content, fixed with improved memory handling (CVE-2020-9948).

An use after free issue may lead to arbitrary code execution with a maliciously crafted web content, fixed with improved memory management (CVE-2020-9951).

An out-of-bounds write issue may lead to code execution with a maliciously crafted web content, fixed with improved bounds checking (CVE-2020-9983).

An use after free issue may lead to arbitrary code execution with a maliciously crafted web content, fixed with improved memory management (CVE-2020-13543).

An use after free issue may lead to arbitrary code execution with a maliciously crafted web content, fixed with improved memory management. (CVE-2020-13584).

This update for webkit2gtk3 fixes the following issues:

-webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451):

• CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution.
• CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution.
• Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531).
• Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087).

This update was imported from the SUSE:SLE-15:Update update project.

This update for webkit2gtk3 fixes the following issues:

-webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451):

• CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution.
• CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution.
• Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531).
• Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for webkit2gtk3 fixes the following issues:

-webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451):

• CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution.
• CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution.
• Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531).
• Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087).

This update for webkit2gtk3 fixes the following issues:

-webkit2gtk3 was updated to version 2.30.3 (bsc#1179122 bsc#1179451):

• CVE-2021-13543: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-13584: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-9948: Fixed a type confusion which could have led to arbitrary code execution.
• CVE-2021-9951: Fixed a use after free which could have led to arbitrary code execution.
• CVE-2021-9983: Fixed an out of bounds write which could have led to arbitrary code execution.
• Have the libwebkit2gtk package require libjavascriptcoregtk of the same version (bsc#1171531).
• Enable c_loop on aarch64: currently needed for compilation to succeed with JIT disabled. Also disable sampling profiler, since it conflicts with c_loop (bsc#1177087).

This update for webkit2gtk3 fixes the following issues:

• Update to version 2.32.1:
  • Improve handling of Media Capture devices.
  • Improve WebAudio playback.
  • Improve video orientation handling.
  • Improve seeking support for MSE playback.
  • Improve flush support in EME decryptors.
  • Fix HTTP status codes for requests done through a custom URI handler.
  • Fix the Bubblewrap sandbox in certain 32-bit systems.
  • Fix inconsistencies between the WebKitWebView.is-muted property state and values returned by webkit_web_view_is_playing_audio().
  • Fix the build with ENABLE_VIDEO=OFF.
  • Fix wrong timestamps for long-lived cookies.
  • Fix UI process crash when failing to load favicons.
  • Fix several crashes and rendering issues.
• Including Security fixes for: CVE-2021-1788, CVE-2021-1844, CVE-2021-1871, CVE-2020-27918, CVE-2020-29623, CVE-2021-1765, CVE-2021-1789, CVE-2021-1799, CVE-2021-1801, CVE-2021-1870, CVE-2020-13558, CVE-2020-13584, CVE-2020-9983, CVE-2020-13543, CVE-2020-9947, CVE-2020-9948, CVE-2020-9951.