Detections
Analytics
Rocky Linux 8 : webkit2gtk3 (RLSA-2022:1777)
high Nessus Plugin ID 161341
Synopsis
The remote Rocky Linux host is missing one or more security updates.Description
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1777 advisory.- A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30809)
- A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30818)
- A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS. (CVE-2021-30823)
- An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory. (CVE-2021-30836)
- The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history. (CVE-2021-30884)
- A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy. (CVE-2021-30887)
- An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content Security Policy reports may be able to leak information via redirect behavior . (CVE-2021-30888)
- A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30889)
- A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2021-30890)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
https://errata.rockylinux.org/RLSA-2022:1777
https://bugzilla.redhat.com/show_bug.cgi?id=1985042
https://bugzilla.redhat.com/show_bug.cgi?id=2017898
https://bugzilla.redhat.com/show_bug.cgi?id=2017901
https://bugzilla.redhat.com/show_bug.cgi?id=2017904
https://bugzilla.redhat.com/show_bug.cgi?id=2018573
https://bugzilla.redhat.com/show_bug.cgi?id=2034347
https://bugzilla.redhat.com/show_bug.cgi?id=2034368
https://bugzilla.redhat.com/show_bug.cgi?id=2034373
https://bugzilla.redhat.com/show_bug.cgi?id=2034376
https://bugzilla.redhat.com/show_bug.cgi?id=2034378
https://bugzilla.redhat.com/show_bug.cgi?id=2034381
https://bugzilla.redhat.com/show_bug.cgi?id=2034383
https://bugzilla.redhat.com/show_bug.cgi?id=2034386
https://bugzilla.redhat.com/show_bug.cgi?id=2034389
https://bugzilla.redhat.com/show_bug.cgi?id=2038907
https://bugzilla.redhat.com/show_bug.cgi?id=2040327
https://bugzilla.redhat.com/show_bug.cgi?id=2040329
https://bugzilla.redhat.com/show_bug.cgi?id=2040331
https://bugzilla.redhat.com/show_bug.cgi?id=2041559
https://bugzilla.redhat.com/show_bug.cgi?id=2044521
https://bugzilla.redhat.com/show_bug.cgi?id=2044528
https://bugzilla.redhat.com/show_bug.cgi?id=2044534
https://bugzilla.redhat.com/show_bug.cgi?id=2044538
https://bugzilla.redhat.com/show_bug.cgi?id=2044542
https://bugzilla.redhat.com/show_bug.cgi?id=2044551
https://bugzilla.redhat.com/show_bug.cgi?id=2044553
https://bugzilla.redhat.com/show_bug.cgi?id=2045291
https://bugzilla.redhat.com/show_bug.cgi?id=2053179
https://bugzilla.redhat.com/show_bug.cgi?id=2053181
https://bugzilla.redhat.com/show_bug.cgi?id=2053185
Plugin Details
Severity: High
ID: 161341
File Name: rocky_linux_RLSA-2022-1777.nasl
Version: 1.4
Type: local
Published: 5/18/2022
Updated: 11/7/2023
Supported Sensors: Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2021-30954
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
CVSS Score Source: CVE-2022-22637
Vulnerability Information
CPE: p-cpe:/a:rocky:linux:webkit2gtk3-devel-debuginfo, p-cpe:/a:rocky:linux:webkit2gtk3-jsc-devel-debuginfo, p-cpe:/a:rocky:linux:webkit2gtk3-jsc-debuginfo, p-cpe:/a:rocky:linux:webkit2gtk3-jsc, p-cpe:/a:rocky:linux:webkit2gtk3-debuginfo, p-cpe:/a:rocky:linux:webkit2gtk3-devel, p-cpe:/a:rocky:linux:webkit2gtk3-debugsource, p-cpe:/a:rocky:linux:webkit2gtk3-jsc-devel, p-cpe:/a:rocky:linux:webkit2gtk3, cpe:/o:rocky:linux:8
Required KB Items: Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/18/2022
Vulnerability Publication Date: 8/24/2021
CISA Known Exploited Vulnerability Due Dates: 2/25/2022
Reference Information
CVE: CVE-2021-30809, CVE-2021-30818, CVE-2021-30823, CVE-2021-30836, CVE-2021-30846, CVE-2021-30848, CVE-2021-30849, CVE-2021-30851, CVE-2021-30884, CVE-2021-30887, CVE-2021-30888, CVE-2021-30889, CVE-2021-30890, CVE-2021-30897, CVE-2021-30934, CVE-2021-30936, CVE-2021-30951, CVE-2021-30952, CVE-2021-30953, CVE-2021-30954, CVE-2021-30984, CVE-2021-45481, CVE-2021-45482, CVE-2021-45483, CVE-2022-22589, CVE-2022-22590, CVE-2022-22592, CVE-2022-22594, CVE-2022-22620, CVE-2022-22637