[Git][security-tracker-team/security-tracker][master] webkit2gtk / wpewebkit upstream advisory WSA-2024-0002
Alberto Garcia (@berto)
berto at debian.org
Tue Mar 26 20:57:50 GMT 2024
Alberto Garcia pushed to branch master at Debian Security Tracker / security-tracker
Commits:
bcbc4812 by Alberto Garcia at 2024-03-26T21:57:24+01:00
webkit2gtk / wpewebkit upstream advisory WSA-2024-0002
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -964,8 +964,22 @@ CVE-2024-23494 (SQL injection vulnerability exists in GetDIAE_unListParameters.)
NOT-FOR-US: Delta Electronics
CVE-2024-0957 (The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shippi ...)
NOT-FOR-US: WordPress plugin
+CVE-2023-42956 [Processing web content may lead to a denial-of-service]
+ - webkit2gtk 2.44.0-1
+ [buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
+ - wpewebkit <unfixed>
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+ [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
+ NOTE: https://webkitgtk.org/security/WSA-2024-0002.html
CVE-2023-42954 (A privilege escalation issue existed in FileMaker Server, potentially ...)
NOT-FOR-US: Claris FileMaker Server
+CVE-2023-42950 [Processing maliciously crafted web content may lead to arbitrary code execution]
+ - webkit2gtk 2.44.0-1
+ [buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
+ - wpewebkit <unfixed>
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+ [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
+ NOTE: https://webkitgtk.org/security/WSA-2024-0002.html
CVE-2024-2742 (Operating system command injection vulnerability in Planet IGS-4215-16 ...)
NOT-FOR-US: Planet IGS-4215-16T2S
CVE-2024-2741 (Cross-Site Request Forgery (CSRF) vulnerability in Planet IGS-4215-16T ...)
@@ -4342,13 +4356,23 @@ CVE-2024-23286 (A buffer overflow issue was addressed with improved memory handl
CVE-2024-23285 (This issue was addressed with improved handling of symlinks. This issu ...)
NOT-FOR-US: Apple
CVE-2024-23284 (A logic issue was addressed with improved state management. This issue ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.44.0-1
+ [buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
+ - wpewebkit <unfixed>
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+ [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
+ NOTE: https://webkitgtk.org/security/WSA-2024-0002.html
CVE-2024-23283 (A privacy issue was addressed with improved private data redaction for ...)
NOT-FOR-US: Apple
CVE-2024-23281 (This issue was addressed with improved state management. This issue is ...)
NOT-FOR-US: Apple
CVE-2024-23280 (An injection issue was addressed with improved validation. This issue ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.44.0-1
+ [buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
+ - wpewebkit <unfixed>
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+ [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
+ NOTE: https://webkitgtk.org/security/WSA-2024-0002.html
CVE-2024-23279 (A privacy issue was addressed with improved private data redaction for ...)
NOT-FOR-US: Apple
CVE-2024-23278 (The issue was addressed with improved checks. This issue is fixed in m ...)
@@ -4380,7 +4404,12 @@ CVE-2024-23265 (A memory corruption vulnerability was addressed with improved lo
CVE-2024-23264 (A validation issue was addressed with improved input sanitization. Thi ...)
NOT-FOR-US: Apple
CVE-2024-23263 (A logic issue was addressed with improved validation. This issue is fi ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.44.0-1
+ [buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
+ - wpewebkit <unfixed>
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+ [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
+ NOTE: https://webkitgtk.org/security/WSA-2024-0002.html
CVE-2024-23262 (This issue was addressed with additional entitlement checks. This issu ...)
NOT-FOR-US: Apple
CVE-2024-23260 (This issue was addressed by removing additional entitlements. This iss ...)
@@ -4394,12 +4423,21 @@ CVE-2024-23257 (The issue was addressed with improved memory handling. This issu
CVE-2024-23255 (An authentication issue was addressed with improved state management. ...)
NOT-FOR-US: Apple
CVE-2024-23254 (The issue was addressed with improved UI handling. This issue is fixed ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.44.0-1
+ [buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
+ - wpewebkit <unfixed>
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+ [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
+ NOTE: https://webkitgtk.org/security/WSA-2024-0002.html
CVE-2024-23253 (A permissions issue was addressed with additional restrictions. This i ...)
NOT-FOR-US: Apple
CVE-2024-23252
- REJECTED
- NOT-FOR-US: Apple
+ - webkit2gtk 2.44.0-1
+ [buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
+ - wpewebkit <unfixed>
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+ [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
+ NOTE: https://webkitgtk.org/security/WSA-2024-0002.html
CVE-2024-23250 (An access issue was addressed with improved access restrictions. This ...)
NOT-FOR-US: Apple
CVE-2024-23249 (The issue was addressed with improved memory handling. This issue is f ...)
@@ -9024,7 +9062,12 @@ CVE-2023-42853 (A logic issue was addressed with improved checks. This issue is
CVE-2023-42848 (The issue was addressed with improved bounds checks. This issue is fix ...)
NOT-FOR-US: Apple
CVE-2023-42843 (An inconsistent user interface issue was addressed with improved state ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.44.0-1
+ [buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
+ - wpewebkit <unfixed>
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+ [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
+ NOTE: https://webkitgtk.org/security/WSA-2024-0002.html
CVE-2023-42840 (The issue was addressed with improved checks. This issue is fixed in m ...)
NOT-FOR-US: Apple
CVE-2023-42839 (This issue was addressed with improved state management. This issue is ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -98,6 +98,8 @@ squid
--
varnish
--
+webkit2gtk (berto)
+--
wpa
--
zabbix
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bcbc48122cd575b0d938c82183ab1e8b384bf5d1
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bcbc48122cd575b0d938c82183ab1e8b384bf5d1
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240326/155a4a16/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list