This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] WebKitGTK and WPE WebKit fix 2 vulnerabilities
WebKitGTK and WPE WebKit version 2.46.4 fix 2 vulnerabilities. Apple is aware of reports that they may have been actively exploited on Mac systems with Intel processors [1][2]. The vulnerabilities were also added to the CISA Known Exploited Vulnerabilities catalog [3]. Individual Apple products and their fixed versions [4][5]: iOS - 17.7.2, 18.1.1 iPadOS - 17.7.2, 18.1.1 Safari - 18.1.1 visionOS - 2.1.1 macOS Sequoia - 15.1.1 Individual Debian releases (package webkit2gtk) and fixed versions of the product [6][7]: bookworm (security) - 2.46.4-1~deb12u1 bullseye (security) - 2.46.4-1~deb11u1 trixie, sid - 2.46.4-1 Red Hat has fixes available for the less severe vulnerability [8]. The systems are not affected by the second vulnerability or no fix has been released; however, affected installations of Red Hat Enterprise Linux 7 can mitigate the impact of this vulnerability by setting the environment variable JavaScriptCoreUseJIT to the value 0 [9].
Allows an unauthenticated remote attacker to execute code on the victim's system via a specially crafted website [4].
The vulnerability is present in products:
- WebKitGTK; >=2.46, <2.46.4;
- WPE WebKit; >=2.46, <2.46.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-44308 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 19. 11. 2024.
Allows an unauthenticated remote attacker to carry out an XSS attack via a specially crafted website [5].
The vulnerability is present in products:
- WebKitGTK; >=2.46, <2.46.4;
- WPE WebKit; >=2.46, <2.46.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
More information:
- CVE-2024-44309 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 19. 11. 2024.
Links
- [1] https://webkitgtk.org/security/WSA-2024-0007.html
- [2] https://wpewebkit.org/security/WSA-2024-0007.html
- [3] https://www.cisa.gov/news-events/alerts/2024/11/21/cisa-adds-three-known-exploited-vulnerabilities-catalog
- [4] https://nvd.nist.gov/vuln/detail/CVE-2024-44308
- [5] https://nvd.nist.gov/vuln/detail/CVE-2024-44309
- [6] https://security-tracker.debian.org/tracker/CVE-2024-44308
- [7] https://security-tracker.debian.org/tracker/CVE-2024-44309
- [8] https://access.redhat.com/security/cve/cve-2024-44309
- [9] https://access.redhat.com/security/cve/cve-2024-44308
By CESNET, z.s.p.o. Michaela Ručková on 29. 11. 2024.