Linux · Security advisory · November 10, 2020

ELSA-2020-4451: Security update for 97 packages

ELSA-2020-4451, released November 10, 2020, fixes 53 CVEs across 97 products. One of them is being exploited (CVE-2019-8720); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
53
None rated Critical
Exploited
1
CVE-2019-8720
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.7740
99th percentile

Priority of the 53 CVEs

Patch now 1 Urgent 0 High 40 Routine 12

Fixed package versions

ProductReleaseFixed in
LibRawol 80:0.19.5-2.el8
LibRaw-develol 80:0.19.5-2.el8
PackageKitol 80:1.1.12-6.0.1.el8
PackageKit-command-not-foundol 80:1.1.12-6.0.1.el8
PackageKit-cronol 80:1.1.12-6.0.1.el8
PackageKit-glibol 80:1.1.12-6.0.1.el8
PackageKit-glib-develol 80:1.1.12-6.0.1.el8
PackageKit-gstreamer-pluginol 80:1.1.12-6.0.1.el8
PackageKit-gtk3-moduleol 80:1.1.12-6.0.1.el8
dleyna-rendererol 80:0.6.0-3.el8
frei0r-develol 80:1.6.1-7.el8
frei0r-pluginsol 80:1.6.1-7.el8
frei0r-plugins-opencvol 80:1.6.1-7.el8
gdmol 81:3.28.3-34.el8
gnome-classic-sessionol 80:3.32.1-11.el8
gnome-control-centerol 80:3.28.2-22.el8
gnome-control-center-filesystemol 80:3.28.2-22.el8
gnome-photosol 80:3.28.1-3.el8
gnome-photos-testsol 80:3.28.1-3.el8
gnome-remote-desktopol 80:0.1.8-3.el8
gnome-sessionol 80:3.28.1-10.0.1.el8
gnome-session-wayland-sessionol 80:3.28.1-10.0.1.el8
gnome-session-xsessionol 80:3.28.1-10.0.1.el8
gnome-settings-daemonol 80:3.32.0-11.el8
gnome-shellol 80:3.32.2-20.el8
gnome-shell-extension-apps-menuol 80:3.32.1-11.el8
gnome-shell-extension-auto-move-windowsol 80:3.32.1-11.el8
gnome-shell-extension-commonol 80:3.32.1-11.el8
gnome-shell-extension-dash-to-dockol 80:3.32.1-11.el8
gnome-shell-extension-desktop-iconsol 80:3.32.1-11.el8
gnome-shell-extension-disable-screenshieldol 80:3.32.1-11.el8
gnome-shell-extension-drive-menuol 80:3.32.1-11.el8
gnome-shell-extension-horizontal-workspacesol 80:3.32.1-11.el8
gnome-shell-extension-launch-new-instanceol 80:3.32.1-11.el8
gnome-shell-extension-native-window-placementol 80:3.32.1-11.el8
gnome-shell-extension-no-hot-cornerol 80:3.32.1-11.el8
gnome-shell-extension-panel-favoritesol 80:3.32.1-11.el8
gnome-shell-extension-places-menuol 80:3.32.1-11.el8
gnome-shell-extension-screenshot-window-sizerol 80:3.32.1-11.el8
gnome-shell-extension-systemMonitorol 80:3.32.1-11.el8
gnome-shell-extension-top-iconsol 80:3.32.1-11.el8
gnome-shell-extension-updates-dialogol 80:3.32.1-11.el8
gnome-shell-extension-user-themeol 80:3.32.1-11.el8
gnome-shell-extension-window-grouperol 80:3.32.1-11.el8
gnome-shell-extension-window-listol 80:3.32.1-11.el8
gnome-shell-extension-windowsNavigatorol 80:3.32.1-11.el8
gnome-shell-extension-workspace-indicatorol 80:3.32.1-11.el8
gnome-terminalol 80:3.28.3-2.el8
gnome-terminal-nautilusol 80:3.28.3-2.el8
gsettings-desktop-schemasol 80:3.32.0-5.el8
gsettings-desktop-schemas-develol 80:3.32.0-5.el8
gtk-docol 80:1.28-2.el8
gtk-update-icon-cacheol 80:3.22.30-6.el8
gtk3ol 80:3.22.30-6.el8
gtk3-develol 80:3.22.30-6.el8
gtk3-immodule-ximol 80:3.22.30-6.el8
gvfsol 80:1.36.2-10.el8
gvfs-afcol 80:1.36.2-10.el8
gvfs-afpol 80:1.36.2-10.el8
gvfs-archiveol 80:1.36.2-10.el8
gvfs-clientol 80:1.36.2-10.el8
gvfs-develol 80:1.36.2-10.el8
gvfs-fuseol 80:1.36.2-10.el8
gvfs-goaol 80:1.36.2-10.el8
gvfs-gphoto2ol 80:1.36.2-10.el8
gvfs-mtpol 80:1.36.2-10.el8
gvfs-smbol 80:1.36.2-10.el8
libsoupol 80:2.62.3-2.el8
libsoup-develol 80:2.62.3-2.el8
mutterol 80:3.32.2-48.el8
mutter-develol 80:3.32.2-48.el8
nautilusol 80:3.28.1-14.el8
nautilus-develol 80:3.28.1-14.el8
nautilus-extensionsol 80:3.28.1-14.el8
pipewireol 80:0.3.6-1.el8
pipewire-develol 80:0.3.6-1.el8
pipewire-docol 80:0.3.6-1.el8
pipewire-libsol 80:0.3.6-1.el8
pipewire-utilsol 80:0.3.6-1.el8
pipewire0.2-develol 80:0.2.7-6.el8
pipewire0.2-libsol 80:0.2.7-6.el8
potraceol 80:1.15-3.el8
pygobject3-develol 80:3.28.3-2.el8
python3-gobjectol 80:3.28.3-2.el8
python3-gobject-baseol 80:3.28.3-2.el8
trackerol 80:2.1.5-2.el8
tracker-develol 80:2.1.5-2.el8
vte-profileol 80:0.52.4-2.el8
vte291ol 80:0.52.4-2.el8
vte291-develol 80:0.52.4-2.el8
webkit2gtk3ol 80:2.28.4-1.el8
webkit2gtk3-develol 80:2.28.4-1.el8
webkit2gtk3-jscol 80:2.28.4-1.el8
webkit2gtk3-jsc-develol 80:2.28.4-1.el8
webrtc-audio-processingol 80:0.3-9.el8
xdg-desktop-portalol 80:1.6.0-2.el8
xdg-desktop-portal-gtkol 80:1.6.0-1.el8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2019-8720 webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a... 8.8 0.0156 KEVExploited
High CVE-2020-9850 iTunes: A logic issue was addressed with improved restrictions. 9.8 0.7740 None reported
High CVE-2019-8820 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0962 None reported
High CVE-2020-9802 iTunes: A logic issue was addressed with improved restrictions. 8.8 0.0827 None reported
High CVE-2020-10018 webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a... 7.5 0.0499 None reported
High CVE-2020-3897 iTunes: A type confusion issue was addressed with improved memory handling. 8.8 0.0466 None reported
High CVE-2020-9895 iTunes: A use after free issue was addressed with improved memory management. 9.8 0.0449 None reported
High CVE-2020-3899 iTunes: A memory consumption issue was addressed with improved memory handling. 8.8 0.0412 None reported
High CVE-2020-15503 webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a... 7.5 0.0367 None reported
High CVE-2020-9893 iTunes: A use after free issue was addressed with improved memory management. 8.8 0.0295 None reported
High CVE-2020-11793 webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a... 8.8 0.0294 None reported
High CVE-2020-9894 iTunes: An out-of-bounds read was addressed with improved input validation. 9.8 0.0284 None reported
High CVE-2020-3868 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0270 None reported
High CVE-2020-3895 iTunes: A memory corruption issue was addressed with improved memory handling. 8.8 0.0264 None reported
High CVE-2019-8816 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0258 None reported
High CVE-2019-8814 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0254 None reported
High CVE-2019-8846 iTunes: A use after free issue was addressed with improved memory management. 8.8 0.0234 None reported
High CVE-2019-8815 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0229 None reported
High CVE-2019-8844 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0227 None reported
High CVE-2019-8835 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0211 None reported
High CVE-2019-8811 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0200 None reported
High CVE-2019-8783 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0195 None reported
High CVE-2020-9862 iTunes: A command injection issue existed in Web Inspector. 7.8 0.0192 None reported
High CVE-2019-8819 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0192 None reported
High CVE-2019-8823 iTunes: Multiple memory corruption issues were addressed with improved memory handling. 8.8 0.0192 None reported
Showing 1 to 25 of 53 1Next