Security update for webkit2gtk3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3874-1 Final 1 1 2021-12-02T07:18:47Z current 2021-12-02T07:18:47Z 2021-12-02T07:18:47Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for webkit2gtk3 This update for webkit2gtk3 fixes the following issues: - CVE-2021-30846: Fixed memory corruption issue that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). - CVE-2021-30851: Fixed memory corruption vulnerability that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-3874,SUSE-SLE-Module-Basesystem-15-SP2-2021-3874,SUSE-SLE-Module-Basesystem-15-SP3-2021-3874,SUSE-SLE-Module-Desktop-Applications-15-SP2-2021-3874,SUSE-SLE-Module-Desktop-Applications-15-SP3-2021-3874 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213874-1/ Link for SUSE-SU-2021:3874-1 https://lists.suse.com/pipermail/sle-security-updates/2021-December/009815.html E-Mail link for SUSE-SU-2021:3874-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1192063 SUSE Bug 1192063 https://www.suse.com/security/cve/CVE-2021-30846/ SUSE CVE CVE-2021-30846 page https://www.suse.com/security/cve/CVE-2021-30851/ SUSE CVE CVE-2021-30851 page SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 libjavascriptcoregtk-4_0-18-2.34.1-18.1 libjavascriptcoregtk-4_0-18-32bit-2.34.1-18.1 libjavascriptcoregtk-4_0-18-64bit-2.34.1-18.1 libwebkit2gtk-4_0-37-2.34.1-18.1 libwebkit2gtk-4_0-37-32bit-2.34.1-18.1 libwebkit2gtk-4_0-37-64bit-2.34.1-18.1 libwebkit2gtk3-lang-2.34.1-18.1 typelib-1_0-JavaScriptCore-4_0-2.34.1-18.1 typelib-1_0-WebKit2-4_0-2.34.1-18.1 typelib-1_0-WebKit2WebExtension-4_0-2.34.1-18.1 webkit-jsc-4-2.34.1-18.1 webkit2gtk-4_0-injected-bundles-2.34.1-18.1 webkit2gtk3-devel-2.34.1-18.1 webkit2gtk3-minibrowser-2.34.1-18.1 libjavascriptcoregtk-4_0-18-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libwebkit2gtk-4_0-37-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libwebkit2gtk3-lang-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 webkit2gtk-4_0-injected-bundles-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libjavascriptcoregtk-4_0-18-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libwebkit2gtk-4_0-37-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libwebkit2gtk3-lang-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 webkit2gtk-4_0-injected-bundles-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 typelib-1_0-JavaScriptCore-4_0-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 typelib-1_0-WebKit2-4_0-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 typelib-1_0-WebKit2WebExtension-4_0-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 webkit2gtk3-devel-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 typelib-1_0-JavaScriptCore-4_0-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 typelib-1_0-WebKit2-4_0-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 typelib-1_0-WebKit2WebExtension-4_0-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 webkit2gtk3-devel-2.34.1-18.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2021-30846 SUSE Linux Enterprise Module for Basesystem 15 SP2:libjavascriptcoregtk-4_0-18-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:libwebkit2gtk-4_0-37-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:libwebkit2gtk3-lang-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:webkit2gtk-4_0-injected-bundles-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libjavascriptcoregtk-4_0-18-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libwebkit2gtk-4_0-37-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libwebkit2gtk3-lang-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:webkit2gtk-4_0-injected-bundles-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-JavaScriptCore-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-WebKit2-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-WebKit2WebExtension-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:webkit2gtk3-devel-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:typelib-1_0-JavaScriptCore-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:typelib-1_0-WebKit2-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:typelib-1_0-WebKit2WebExtension-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:webkit2gtk3-devel-2.34.1-18.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213874-1/ https://www.suse.com/security/cve/CVE-2021-30846.html CVE-2021-30846 https://bugzilla.suse.com/1192063 SUSE Bug 1192063 A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution. CVE-2021-30851 SUSE Linux Enterprise Module for Basesystem 15 SP2:libjavascriptcoregtk-4_0-18-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:libwebkit2gtk-4_0-37-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:libwebkit2gtk3-lang-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:webkit2gtk-4_0-injected-bundles-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libjavascriptcoregtk-4_0-18-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libwebkit2gtk-4_0-37-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libwebkit2gtk3-lang-2.34.1-18.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:webkit2gtk-4_0-injected-bundles-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-JavaScriptCore-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-WebKit2-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-WebKit2WebExtension-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:webkit2gtk3-devel-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:typelib-1_0-JavaScriptCore-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:typelib-1_0-WebKit2-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:typelib-1_0-WebKit2WebExtension-4_0-2.34.1-18.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:webkit2gtk3-devel-2.34.1-18.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213874-1/ https://www.suse.com/security/cve/CVE-2021-30851.html CVE-2021-30851 https://bugzilla.suse.com/1192063 SUSE Bug 1192063