Detections
Analytics

openSUSE 15 Security Update : webkit2gtk3 (openSUSE-SU-2021:2598-1)

high Nessus Plugin ID 152196

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2598-1 advisory.

 - A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage. (CVE-2021-21775)

 - A use-after-free vulnerability exists in the way Webkits GraphicsContext handles certain events in WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability.
 (CVE-2021-21779)

 - An integer overflow was addressed with improved input validation. (CVE-2021-30663)

 - A memory corruption issue was addressed with improved state management. (CVE-2021-30665)

 - A logic issue was addressed with improved state management. (CVE-2021-30689)

 - A logic issue was addressed with improved restrictions. (CVE-2021-30720)

 - Multiple memory corruption issues were addressed with improved memory handling. (CVE-2021-30734, CVE-2021-30749, CVE-2021-30799)

 - A cross-origin issue with iframe elements was addressed with improved tracking of security origins.
 (CVE-2021-30744)

 - A type confusion issue was addressed with improved state handling. (CVE-2021-30758)

 - A use after free issue was addressed with improved memory management. (CVE-2021-30795)

 - This issue was addressed with improved checks. (CVE-2021-30797)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1188697

http://www.nessus.org/u?ad3cd3c5

https://www.suse.com/security/cve/CVE-2021-21775

https://www.suse.com/security/cve/CVE-2021-21779

https://www.suse.com/security/cve/CVE-2021-30663

https://www.suse.com/security/cve/CVE-2021-30665

https://www.suse.com/security/cve/CVE-2021-30689

https://www.suse.com/security/cve/CVE-2021-30720

https://www.suse.com/security/cve/CVE-2021-30734

https://www.suse.com/security/cve/CVE-2021-30744

https://www.suse.com/security/cve/CVE-2021-30749

https://www.suse.com/security/cve/CVE-2021-30758

https://www.suse.com/security/cve/CVE-2021-30795

https://www.suse.com/security/cve/CVE-2021-30797

https://www.suse.com/security/cve/CVE-2021-30799

Plugin Details

Severity: High

ID: 152196

File Name: openSUSE-2021-2598.nasl

Version: 1.6

Type: local

Agent: unix

Published: 8/4/2021

Updated: 4/25/2023

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-30799

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:typelib-1_0-javascriptcore-4_0, p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37, p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18, p-cpe:/a:novell:opensuse:webkit2gtk3-devel, p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit, p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser, p-cpe:/a:novell:opensuse:libwebkit2gtk3-lang, p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit, p-cpe:/a:novell:opensuse:typelib-1_0-webkit2webextension-4_0, cpe:/o:novell:opensuse:15.3, p-cpe:/a:novell:opensuse:typelib-1_0-webkit2-4_0, p-cpe:/a:novell:opensuse:webkit-jsc-4, p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/3/2021

Vulnerability Publication Date: 4/29/2021

CISA Known Exploited Vulnerability Due Dates: 11/17/2021

Reference Information

CVE: CVE-2021-21775, CVE-2021-21779, CVE-2021-30663, CVE-2021-30665, CVE-2021-30689, CVE-2021-30720, CVE-2021-30734, CVE-2021-30744, CVE-2021-30749, CVE-2021-30758, CVE-2021-30795, CVE-2021-30797, CVE-2021-30799