Red Hat Security Advisory

RHSA-2022:1777

webkit2gtk3 security, bug fix, and enhancement update

Released 2022-05-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3-2.34.6-1.el8, webkit2gtk3-devel-2.34.6-1.el8, webkit2gtk3-jsc-2.34.6-1.el8 +1

Fixes 30 records

TI-2022-06885 CVE-2022-22620 · GHSA-2886-x646-53fj

Use after free in Apple Safari

CRITICAL 97KEV

A use after free issue was addressed with improved memory management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.16342 Published 2022-03-18 Fixed in 15.3, 12.2 CWE-416

TI-2021-11319 CVE-2021-30952

Integer overflow in Apple watchOS

CRITICAL 97KEV

An integer overflow was addressed with improved input validation.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.06964 Published 2021-08-24 Partial fix · 8.3, 15.2 +1 CWE-190

TI-2021-11301 CVE-2021-30934

Buffer overflow in Apple watchOS

MEDIUM 43

A buffer overflow issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02641 Published 2021-08-24 Partial fix · 8.3, 15.2 +1 CWE-120

TI-2021-11223 CVE-2021-30851

Out-of-bounds write in Apple iOS and iPadOS

MEDIUM 43

A memory corruption vulnerability was addressed with improved locking.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02394 Published 2021-08-24 Partial fix · 15, 8 CWE-787

TI-2021-11320 CVE-2021-30953

Out-of-bounds read in Apple watchOS

MEDIUM 42

An out-of-bounds read was addressed with improved bounds checking.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01952 Published 2021-08-24 Partial fix · 8.3, 15.2 +1 CWE-125

TI-2021-11318 CVE-2021-30951

Use after free in Apple watchOS

MEDIUM 42

A use after free issue was addressed with improved memory management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0202 Published 2021-08-24 Partial fix · 8.3, 15.2 +1 CWE-416

TI-2021-11303 CVE-2021-30936

Use after free in Apple watchOS

MEDIUM 42

A use after free issue was addressed with improved memory management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01992 Published 2021-08-24 Partial fix · 8.3, 15.2 +1 CWE-416

TI-2021-11258 CVE-2021-30889

Buffer overflow in Apple iOS and iPadOS

MEDIUM 42

A buffer overflow issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01932 Published 2021-08-24 Partial fix · 15.1, 12.0 +1 CWE-120

TI-2022-06901 CVE-2022-22637 · GHSA-p38h-v883-px7v

Origin validation error in Apple Safari

MEDIUM 41

A logic issue was addressed with improved state management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00761 Published 2022-09-23 Partial fix · 15.4, 12.3 +1 CWE-346

TI-2022-06857 CVE-2022-22590 · GHSA-8gq6-m624-5hx9

Use after free in Apple iOS and iPadOS

MEDIUM 41

A use after free issue was addressed with improved memory management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01555 Published 2022-03-18 Partial fix · 15.3, 12.2 +1 CWE-416

TI-2021-11192 CVE-2021-30818 · GHSA-rx33-r3jc-7m3x

Type confusion in Apple iOS and iPadOS

MEDIUM 41

A type confusion issue was addressed with improved state handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01618 Published 2021-10-28 Partial fix · 14.8, 15 +1 CWE-843

TI-2021-11184 CVE-2021-30809 · GHSA-6gcj-5f9m-97rp

Use after free in Apple iOS and iPadOS

MEDIUM 41

A use after free issue was addressed with improved memory management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01511 Published 2021-10-28 Partial fix · 15, 8 CWE-416

TI-2021-11221 CVE-2021-30849 · GHSA-4jcp-gxvj-75jh

Out-of-bounds write in Apple iOS and iPadOS

LOW 38

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01904 Published 2021-10-19 Partial fix · 14.8, 15 +2 CWE-787

TI-2021-11321 CVE-2021-30954

Type confusion in Apple watchOS

LOW 37

A type confusion issue was addressed with improved memory handling.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01452 Published 2021-08-24 Partial fix · 8.3, 15.2 +1 CWE-843

TI-2021-11220 CVE-2021-30848 · GHSA-wj2m-cc2g-mxw2

Out-of-bounds write in Apple iOS and iPadOS

LOW 37

A memory corruption issue was addressed with improved memory handling.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.0127 Published 2021-10-19 Partial fix · 14.8, 15 CWE-787

TI-2021-11218 CVE-2021-30846 · GHSA-28cj-vpvc-jgj6

Out-of-bounds write in Apple iOS and iPadOS

LOW 37

A memory corruption issue was addressed with improved memory handling.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01355 Published 2021-10-19 Partial fix · 14.8, 15 +1 CWE-787

TI-2021-11349 CVE-2021-30984

Race condition in Apple watchOS

LOW 36

A race condition was addressed with improved state handling.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.0167 Published 2021-08-24 Partial fix · 8.3, 15.2 +1 CWE-362

TI-2021-11257 CVE-2021-30888

Open redirect in Apple iOS and iPadOS

LOW 36

An information leakage issue was addressed.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.01729 Published 2021-08-24 Partial fix · 15.1, 14.8 +2 CWE-601

TI-2021-11196 CVE-2021-30823 · GHSA-fmvg-g54p-g6qj

Apple iOS and iPadOS: An attacker in a privileged network position may be able to bypass…

LOW 33

A logic issue was addressed with improved restrictions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02231 Published 2021-10-28 Partial fix · 14.8, 15 +2

TI-2022-06859 CVE-2022-22592 · GHSA-4r4q-3gg9-w59h

Apple iOS and iPadOS: Processing maliciously crafted web content may prevent Content…

LOW 32

A logic issue was addressed with improved state management.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01623 Published 2022-03-18 Partial fix · 15.3, 12.2 +1

TI-2021-20570 CVE-2021-45483 · GHSA-h8mj-hhrj-rvh6

In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a…

LOW 32

In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-30889.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0152 Published 2021-12-25 Partial fix CWE-416

TI-2021-20569 CVE-2021-45482 · GHSA-73cm-q45j-cwwr

In WebKitGTK before 2.32.4, there is a use-after-free in…

LOW 32

In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01532 Published 2021-12-25 Partial fix CWE-416

TI-2021-20568 CVE-2021-45481 · GHSA-p53f-pm5m-wpj7

In WebKitGTK before 2.32.4, there is incorrect memory allocation in…

LOW 32

In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application crash, a different vulnerability than CVE-2021…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01532 Published 2021-12-25 Partial fix CWE-401

TI-2021-11264 CVE-2021-30897

An issue existed in the specification for the resource timing API.

LOW 32

An issue existed in the specification for the resource timing API.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01714 Published 2021-08-24 Partial fix · 12.0

TI-2021-11256 CVE-2021-30887

Apple iOS and iPadOS: Processing maliciously crafted web content may lead to unexpectedly…

LOW 32

A logic issue was addressed with improved restrictions.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01784 Published 2021-08-24 Partial fix · 15.1, 12.0 +1

TI-2022-06856 CVE-2022-22589 · GHSA-4c33-fwgf-qv6r

Apple iOS and iPadOS: Processing a maliciously crafted mail message may lead to running…

LOW 31

A validation issue was addressed with improved input sanitization.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02005 Published 2022-03-18 Partial fix · 15.3, 12.2 +1

TI-2022-06861 CVE-2022-22594 · GHSA-3xf9-qwxv-r3r4

Origin validation error in Apple iOS and iPadOS

LOW 30

A cross-origin issue in the IndexDB API was addressed with improved input validation.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00821 Published 2022-03-18 Partial fix · 15.3, 12.2 +1 CWE-346

TI-2021-11259 CVE-2021-30890

Cross-site scripting in Apple iOS and iPadOS

LOW 30

A logic issue was addressed with improved state management.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01456 Published 2021-08-24 Partial fix · 15.1, 12.0 +1 CWE-79

TI-2021-11209 CVE-2021-30836 · GHSA-92w6-fxxp-58w5

Out-of-bounds read in Apple iOS and iPadOS

LOW 27

An out-of-bounds read was addressed with improved input validation.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01104 Published 2021-10-28 Partial fix · 14.8, 15 +1 CWE-125

TI-2021-11254 CVE-2021-30884

The issue was resolved with additional restrictions on CSS compositing.

LOW 24

The issue was resolved with additional restrictions on CSS compositing.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.0115 Published 2021-08-24 Partial fix · 15, 8