| Beschreibung: | Summary:
The remote host is missing an update for the 'webkit2' package(s) announced via the MGASA-2021-0400 advisory.
Vulnerability Insight:
Updated webkit2 packages fix security vulnerabilities:
A use-after-free vulnerability exists in the way certain events are
processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially
crafted web page can lead to a potential information leak and further
memory corruption. In order to trigger the vulnerability, a victim must
be tricked into visiting a malicious webpage (CVE-2021-21775).
A use-after-free vulnerability exists in the way Webkit GraphicsContext
handles certain events in WebKitGTK 2.30.4. A specially crafted web page
can lead to a potential information leak and further memory corruption.
A victim must be tricked into visiting a malicious web page to trigger
this vulnerability (CVE-2021-21779).
Processing maliciously crafted web content may lead to arbitrary code
execution (CVE-2021-30663, CVE-2021-30665, CVE-2021-30734, CVE-2021-30749,
CVE-2021-30758, CVE-2021-30795, CVE-2021-30797, CVE-2021-30799).
Processing maliciously crafted web content may lead to universal cross
site scripting (CVE-2021-30689, CVE-2021-30744).
A malicious website may be able to access restricted ports on arbitrary
servers (CVE-2021-30720).
Affected Software/OS:
'webkit2' package(s) on Mageia 8.
Solution:
Please install the updated package(s).
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
