# RHSA-2024:9636: Security update for 4 packages RHSA-2024:9636, released November 14, 2024, fixes 21 CVEs across 4 products. One of them is being exploited (CVE-2024-27834); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/linux/rhsa-2024-9636 - Platform: Linux - Released: Nov 14, 2024 - Priority: Patch now (Closes CVE-2024-27834, exploited (CISA KEV)) - CVEs: 21, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://access.redhat.com/errata/RHSA-2024:9636 ## Applies to | Product | Release | Fixed in | |---|---|---| | [webkit2gtk3](https://patchblox.com/security/data/product/linux/webkit2gtk3.md) | RHEL 8 | 0:2.46.3-1.el8_10 | | [webkit2gtk3-devel](https://patchblox.com/security/data/product/linux/webkit2gtk3-devel.md) | RHEL 8 | 0:2.46.3-1.el8_10 | | [webkit2gtk3-jsc](https://patchblox.com/security/data/product/linux/webkit2gtk3-jsc.md) | RHEL 8 | 0:2.46.3-1.el8_10 | | [webkit2gtk3-jsc-devel](https://patchblox.com/security/data/product/linux/webkit2gtk3-jsc-devel.md) | RHEL 8 | 0:2.46.3-1.el8_10 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2024-27834](https://patchblox.com/security/data/cve/CVE-2024-27834.md) | Patch now | WebKit: An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication | 8.8 | 0.0150 | CISA KEV | | [CVE-2024-4558](https://patchblox.com/security/data/cve/CVE-2024-4558.md) | High | Chromium: CVE-2024-4558 Use after free in ANGLE | 9.6 | 0.0153 | | | [CVE-2023-42950](https://patchblox.com/security/data/cve/CVE-2023-42950.md) | High | webkit2gtk3: This update for webkit2gtk3 fixes the following issues: - Update to version 2.44.2 (bsc#1225071): - CVE-2024-23252:... | 8.8 | 0.0107 | | | [CVE-2024-54534](https://patchblox.com/security/data/cve/CVE-2024-54534.md) | High | WebKit: Processing maliciously crafted web content may lead to memory corruption | 9.8 | 0.0105 | | | [CVE-2024-27820](https://patchblox.com/security/data/cve/CVE-2024-27820.md) | High | WebKit Web Inspector: Processing web content may lead to arbitrary code execution | 8.8 | 0.0102 | | | [CVE-2023-43010](https://patchblox.com/security/data/cve/CVE-2023-43010.md) | High | webkit2gtk3: This update for webkit2gtk3 fixes the following issues: Update to version 2.52.0. Security issues fixed: - CVE... | 8.8 | 0.0094 | | | [CVE-2024-27851](https://patchblox.com/security/data/cve/CVE-2024-27851.md) | High | WebKit: Processing maliciously crafted web content may lead to arbitrary code execution | 8.8 | 0.0082 | | | [CVE-2024-23271](https://patchblox.com/security/data/cve/CVE-2024-23271.md) | High | Unknown | 7.3 | 0.0080 | | | [CVE-2024-27856](https://patchblox.com/security/data/cve/CVE-2024-27856.md) | High | WebKit: Processing a file may lead to unexpected app termination or arbitrary code execution | 8.8 | 0.0062 | | | [CVE-2025-43480](https://patchblox.com/security/data/cve/CVE-2025-43480.md) | High | WebKit: A malicious website may exfiltrate data cross-origin | 8.8 | 0.0049 | | | [CVE-2024-40789](https://patchblox.com/security/data/cve/CVE-2024-40789.md) | Routine | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 6.5 | 0.0115 | | | [CVE-2024-40782](https://patchblox.com/security/data/cve/CVE-2024-40782.md) | Routine | gir1.2-webkit2-4.0: A use-after-free issue was addressed with improved memory management | 6.5 | 0.0098 | | | [CVE-2024-44244](https://patchblox.com/security/data/cve/CVE-2024-44244.md) | Routine | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 4.3 | 0.0096 | | | [CVE-2024-40866](https://patchblox.com/security/data/cve/CVE-2024-40866.md) | Routine | WebKit: Visiting a malicious website may lead to address bar spoofing | 6.5 | 0.0093 | | | [CVE-2024-27838](https://patchblox.com/security/data/cve/CVE-2024-27838.md) | Routine | WebKit: A maliciously crafted webpage may be able to fingerprint the user | 6.5 | 0.0073 | | | [CVE-2024-40780](https://patchblox.com/security/data/cve/CVE-2024-40780.md) | Routine | webkit2gtk-driver: An out-of-bounds read was addressed with improved bounds checking | 6.5 | 0.0070 | | | [CVE-2024-44296](https://patchblox.com/security/data/cve/CVE-2024-44296.md) | Routine | WebKit: Processing maliciously crafted web content may prevent Content Security Policy from being enforced | 5.4 | 0.0066 | | | [CVE-2024-44187](https://patchblox.com/security/data/cve/CVE-2024-44187.md) | Routine | WebKit: A malicious website may exfiltrate data cross-origin | 6.5 | 0.0065 | | | [CVE-2024-54658](https://patchblox.com/security/data/cve/CVE-2024-54658.md) | Routine | WebKit: Processing web content may lead to a denial-of-service | 6.5 | 0.0054 | | | [CVE-2024-40779](https://patchblox.com/security/data/cve/CVE-2024-40779.md) | Routine | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 6.5 | 0.0034 | | | [CVE-2024-44185](https://patchblox.com/security/data/cve/CVE-2024-44185.md) | Routine | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 5.5 | 0.0029 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo