This update for webkit2gtk3 fixes the following issues:
Update to version 2.46.3 (bsc#1232747), including fixes for:
- CVE-2024-44308: Fixed arbitrary code execution by not allocating DFG register after a slow path (bsc#1233631).
- CVE-2024-44309: Fixed a data isolation bypass vulnerability (bsc#1233632).
- CVE-2024-44244: Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2024-44296: Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.44.3 (bsc#1228696 bsc#1228697 bsc#1228698):
- Fix web process cache suspend/resume when sandbox is enabled.
- Fix accelerated images dissapearing after scrolling.
- Fix video flickering with DMA-BUF sink.
- Fix pointer lock on X11.
- Fix movement delta on mouse events in GTK3.
- Undeprecate console message API and make it available in 2022 API.
- Fix several crashes and rendering issues.
- Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
CVE-2024-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
CVE-2024-4558.
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.44.2
- CVE-2024-27834: Fixed a vulnerability where an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. (bsc#1225071)
This update for webkit2gtk3 fixes the following issues:
- CVE-2024-23252: Fixed denial of service via crafted web content (bsc#1222010).
- CVE-2024-23254: Fixed possible audio data exilftration cross-origin via malicious website (bsc#1222010).
- CVE-2024-23263: Fixed lack of Content Security Policy enforcing via malicious crafted web content (bsc#1222010).
- CVE-2024-23280: Fixed possible user fingeprint via malicious crafted web content (bsc#1222010).
- CVE-2024-23284: Fixed lack of Content Security Policy enforcing via malicious crafted web content
This update for webkit2gtk3 fixes the following issues:
Update to version 2.42.5 (bsc#1219604):
- CVE-2024-23222: Fixed processing maliciously crafted web content that may have led to arbitrary code execution (bsc#1219113).
- CVE-2024-23206: Fixed fingerprint user via maliciously crafted webpages (bsc#1219604).
- CVE-2024-23213: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).
- CVE-2023-40414: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).
- CVE-2014-1745: Fixed denial-of-service or potentially disclose memory contents while processing maliciously crafted f
This update for webkit2gtk3 fixes the following issues:
- CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033).
- CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032).
- CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870).
- CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1218032, bsc#1215868).
This update for webkit2gtk3 fixes the following issues:
Update to version 2.42.3 (bsc#1217844):
- Fix flickering while playing videos with DMA-BUF sink.
- Fix color picker being triggered in the inspector when typing 'tan'.
- Do not special case the 'sans' font family name.
- Fix build failure with libxml2 version 2.12.0 due to an API change.
- Fix several crashes and rendering issues.
- Security fixes: CVE-2023-42916, CVE-2023-42917.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.42.2 (bsc#1217210):
- CVE-2023-41983: Processing web content may lead to a denial-of-service.
- CVE-2023-42852: Processing web content may lead to arbitrary code execution.
Already previously fixed:
- CVE-2022-32919: Visiting a website that frames malicious content may lead to UI spoofing (fixed already in 2.38.4).
- CVE-2022-32933: A website may be able to track the websites a user visited in private browsing mode (fixed already in 2.38.0).
- CVE-2022-46705: Visiting a malicious website may lead to address bar spoofing (fixed already in 2.38.4).
- CVE-2022-46725:
This update for webkit2gtk3 ships missing Lang packages to SUSE Linux Enterprise 15 SP4 and SP5.
Security fixes:
- CVE-2023-41993: Fixed an issue where processing malicious web
content could have lead to arbitrary code execution (bsc#1215661).
- CVE-2023-39928: Fixed a use-after-free that could be exploited to
execute arbitrary code when visiting a malicious webpage
(bsc#1215868).
- CVE-2023-41074: Fixed an issue where processing malicious web
content could have lead to arbitrary code execution (bsc#1215870).
Other fixes:
- Fixed missing package dependencies (bsc#1215072).
This update for webkit2gtk3 fixes the following issues:
- Expand lang sub-package in spec file unconditionally to handle
previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
change affected the automatic generated Requires tag on
WebKit2GTK-%{_apiver}, then getting out of sync of what's being
required and what's being provided. Now, any sub-package that was
providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
instead (bsc#1214835, bsc#1214640, bsc#1214093).
- Require libwaylandclient0 >= 1.20. 15.4 originally had 1.19.0,
but webkitgtk uses a function added in 1.20.0, so we need to
ensure that the wa
This update for webkit2gtk3 fixes the following issues:
- Provide/obsolete WebKit2GTK-%{_apiver}-lang (bsc#1214093)
- Have the lang package provide libwebkit2gtk3-lang (bsc#1214093)
- Adjustments of update version 2.40.5 (bsc#1213905 bsc#1213379 bsc#1213581):
+ Added missing CVE references: CVE-2023-32393, CVE-2023-37450
This update for webkit2gtk3 fixes the following issues:
Add security patches (bsc#1211846):
- CVE-2023-28204: Fixed processing of web content that may disclose sensitive information (bsc#1211659).
- CVE-2023-32373: Fixed processing of maliciously crafted web content that may lead to arbitrary code execution (bsc#1211658).