Test ID:	1.3.6.1.4.1.25623.1.1.1.1.2023.5396
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-5396-1)
Summary:	The remote host is missing an update for the Debian 'webkit2gtk' package(s) announced via the DSA-5396-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'webkit2gtk' package(s) announced via the DSA-5396-1 advisory. Vulnerability Insight: The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2022-0108 Luan Herrera discovered that an HTML document may be able to render iframes with sensitive user information. CVE-2022-32885 P1umer and Q1IQ discovered that processing maliciously crafted web content may lead to arbitrary code execution. CVE-2023-27932 An anonymous researcher discovered that processing maliciously crafted web content may bypass Same Origin Policy. CVE-2023-27954 An anonymous researcher discovered that a website may be able to track sensitive user information. CVE-2023-28205 Clement Lecigne and Donncha O Cearbhaill discovered that processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. For the stable distribution (bullseye), these problems have been fixed in version 2.40.1-1~ deb11u1. We recommend that you upgrade your webkit2gtk packages. For the detailed security status of webkit2gtk please refer to its security tracker page at: [link moved to references] Affected Software/OS: 'webkit2gtk' package(s) on Debian 11. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-0108 Debian Security Information: DSA-5396 (Google Search) https://www.debian.org/security/2023/dsa-5396 Debian Security Information: DSA-5397 (Google Search) https://www.debian.org/security/2023/dsa-5397 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QL5OGMSHRQ26FTYWZUXVNWB2VHOSVXK/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KC7DMUX37BRCLAI4VPQYHDUVEGTNYN5A/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5OKKVEUQAAGH3NHMX3WHWKRPYU4QFKTQ/ https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html https://crbug.com/1248444 https://lists.debian.org/debian-lts-announce/2023/05/msg00011.html http://www.openwall.com/lists/oss-security/2023/04/21/3 Common Vulnerability Exposure (CVE) ID: CVE-2022-32885 https://support.apple.com/en-us/HT213341 https://support.apple.com/en-us/HT213345 https://support.apple.com/en-us/HT213346 Common Vulnerability Exposure (CVE) ID: CVE-2023-27932 https://support.apple.com/en-us/HT213670 https://support.apple.com/en-us/HT213671 https://support.apple.com/en-us/HT213674 https://support.apple.com/en-us/HT213676 https://support.apple.com/en-us/HT213678 Common Vulnerability Exposure (CVE) ID: CVE-2023-27954 https://support.apple.com/en-us/HT213673 Common Vulnerability Exposure (CVE) ID: CVE-2023-28198 https://security.gentoo.org/glsa/202401-04 http://www.openwall.com/lists/oss-security/2023/09/11/1 Common Vulnerability Exposure (CVE) ID: CVE-2023-28205 https://support.apple.com/en-us/HT213720 https://support.apple.com/en-us/HT213721 https://support.apple.com/en-us/HT213722 https://support.apple.com/en-us/HT213723 Common Vulnerability Exposure (CVE) ID: CVE-2023-32370 Common Vulnerability Exposure (CVE) ID: CVE-2023-32393 https://support.apple.com/en-us/HT213599 https://support.apple.com/en-us/HT213601 https://support.apple.com/en-us/HT213605 https://support.apple.com/en-us/HT213606 Common Vulnerability Exposure (CVE) ID: CVE-2023-32435 https://support.apple.com/en-us/HT213811 Common Vulnerability Exposure (CVE) ID: CVE-2023-35074 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/ http://seclists.org/fulldisclosure/2023/Oct/2 http://seclists.org/fulldisclosure/2023/Oct/3 http://seclists.org/fulldisclosure/2023/Oct/8 http://seclists.org/fulldisclosure/2023/Oct/9 http://seclists.org/fulldisclosure/2023/Oct/10 https://security.gentoo.org/glsa/202401-33 https://support.apple.com/en-us/HT213936 https://support.apple.com/en-us/HT213937 https://support.apple.com/en-us/HT213938 https://support.apple.com/en-us/HT213940 https://support.apple.com/en-us/HT213941 http://www.openwall.com/lists/oss-security/2023/09/28/3
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.