This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] WebKitGTK and WPE WebKit fix 6 vulnerabilities
WebKitGTK and WPE WebKit fix 6 vulnerabilities in version 2.44.3 [1]. Gentoo fixed the vulnerabilities in the testing version [9]. Individual Apple products and fixed versions [2][3][4][5][6][7]: iOS - 16.7.9, 17.6 iPadOS - 16.7.9, 17.6 Safari - 17.6 watchOS - 10.6 tvOS - 17.6 visionOS - 1.3 macOS Sonoma - 14.6 Individual Debian releases (package webkit2gtk) and fixed product versions [8]: bookworm - 2.44.2-1~deb12u1 bookworm (security) - 2.44.3-1~deb12u1 trixie, sid - 2.44.3-1
An unauthenticated remote attacker can carry out a DoS attack on a victim viewing a specially crafted website [1].
The vulnerability is present in product:
- WebKitGTK; <2.44.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
More information:
- CVE-2024-40789 at cve.org, NVD
- CWE-248: Uncaught Exception at cwe.mitre.org
The vulnerability was publicly disclosed 17. 8. 2024.
An unauthenticated remote attacker can carry out a DoS attack, corrupt data in memory or execute code on a victim viewing a specially crafted website [1][10][6].
The vulnerability is present in product:
- WebKitGTK; <2.44.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-40782 at cve.org, NVD
- CVE-2024-40776 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 17. 8. 2024.
An unauthenticated remote attacker can gain unauthorized access to information or carry out a DoS attack on a victim viewing a specially crafted website [1][5][4].
The vulnerability is present in product:
- WebKitGTK; <2.44.3;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
More information:
- CVE-2024-40779 at cve.org, NVD
- CVE-2024-40780 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
The vulnerability was publicly disclosed 17. 8. 2024.
An unauthenticated remote attacker can carry out a DoS attack, corrupt data in memory or execute code on a victim viewing a specially crafted website [1][7].
The vulnerability is present in product:
- WebKitGTK; <2.44.3;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-4558 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 17. 8. 2024.
Links
- [1] https://webkitgtk.org/security/WSA-2024-0004.html
- [2] https://github.com/advisories/GHSA-6mp9-hrx8-6ffg
- [3] https://github.com/advisories/GHSA-4rw8-cxgp-9r2g
- [4] https://github.com/advisories/GHSA-j573-cwg3-wh35
- [5] https://github.com/advisories/GHSA-7j6x-9hgr-mv7c
- [6] https://github.com/advisories/GHSA-4645-h4xp-pj82
- [7] https://github.com/advisories/GHSA-r4j8-j63p-24j8
- [8] https://security-tracker.debian.org/tracker/source-package/webkit2gtk
- [9] https://packages.gentoo.org/packages/net-libs/webkit-gtk
- [10] https://github.com/advisories/GHSA-6hq7-9r57-p64g
By CESNET, z.s.p.o. Martin Krajči on 2. 9. 2024.