Linux · Security advisory · November 4, 2020

RHSA-2020:4451: Security update for 7 packages

RHSA-2020:4451, released November 4, 2020, fixes 57 CVEs across 7 products. 4 of them are being exploited (CVE-2021-30762); 4 on CISA KEV. Patch Radar priority: Patch now.

Patch now4 on CISA KEV

CVEs closed

None rated Critical

Exploited

CVE-2021-30762

Exploitation more likely

Vendor assessment

Highest EPSS

0.7740

99th percentile

Priority of the 57 CVEs

Patch now 4
                                Urgent 0
                                High 41
                                Routine 12

Fixed package versions

Product	Release	Fixed in
LibRaw	RHEL 8	0:0.19.5-2.el8
LibRaw-devel	RHEL 8	0:0.19.5-2.el8
gnome-settings-daemon	RHEL 8	0:3.32.0-11.el8
webkit2gtk3	RHEL 8	0:2.28.4-1.el8
webkit2gtk3-devel	RHEL 8	0:2.28.4-1.el8
webkit2gtk3-jsc	RHEL 8	0:2.28.4-1.el8
webkit2gtk3-jsc-devel	RHEL 8	0:2.28.4-1.el8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2021-30762	gnome-settings-daemon: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.1099	KEVExploited
Patch now	CVE-2021-30761	gnome-settings-daemon: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.1055	KEVExploited
Patch now	CVE-2021-30666	gnome-settings-daemon: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0300	KEVExploited
Patch now	CVE-2019-8720	webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0156	KEVExploited
High	CVE-2020-9850	iTunes: A logic issue was addressed with improved restrictions.	9.8	0.7740	None reported
High	CVE-2019-8820	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0962	None reported
High	CVE-2020-9802	iTunes: A logic issue was addressed with improved restrictions.	8.8	0.0827	None reported
High	CVE-2020-10018	webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	7.5	0.0499	None reported
High	CVE-2020-3897	iTunes: A type confusion issue was addressed with improved memory handling.	8.8	0.0466	None reported
High	CVE-2020-9895	iTunes: A use after free issue was addressed with improved memory management.	9.8	0.0449	None reported
High	CVE-2020-3899	iTunes: A memory consumption issue was addressed with improved memory handling.	8.8	0.0412	None reported
High	CVE-2020-15503	webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	7.5	0.0367	None reported
High	CVE-2020-9893	iTunes: A use after free issue was addressed with improved memory management.	8.8	0.0295	None reported
High	CVE-2020-11793	webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0294	None reported
High	CVE-2020-9894	iTunes: An out-of-bounds read was addressed with improved input validation.	9.8	0.0284	None reported
High	CVE-2020-3868	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0270	None reported
High	CVE-2020-3895	iTunes: A memory corruption issue was addressed with improved memory handling.	8.8	0.0264	None reported
High	CVE-2019-8816	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0258	None reported
High	CVE-2019-8814	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0254	None reported
High	CVE-2019-8846	iTunes: A use after free issue was addressed with improved memory management.	8.8	0.0234	None reported
High	CVE-2019-8815	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0229	None reported
High	CVE-2019-8844	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0227	None reported
High	CVE-2019-8835	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0211	None reported
High	CVE-2019-8811	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0200	None reported
High	CVE-2019-8783	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0195	None reported

Also fixes CVE-2021-30762

gir1.2-javascriptcoregtk-4.0 2.28.0-0ubuntu0.18.04.3
gir1.2-javascriptcoregtk-4.0 on Ubuntu 18.04.6 LTS (bionic)
gir1.2-javascriptcoregtk-4.0 2.28.0-1ubuntu2
gir1.2-javascriptcoregtk-4.0 on Ubuntu 20.04 LTS (focal)
gir1.2-webkit2-4.0 2.28.0-0ubuntu0.18.04.3
gir1.2-webkit2-4.0 on Ubuntu 18.04.6 LTS (bionic)
gir1.2-webkit2-4.0 2.28.0-1ubuntu2
gir1.2-webkit2-4.0 on Ubuntu 20.04 LTS (focal)
libjavascriptcoregtk-4.0-18 2.28.0-0ubuntu0.18.04.3
libjavascriptcoregtk-4.0-18 on Ubuntu 18.04.6 LTS (bionic)
libjavascriptcoregtk-4.0-18 2.28.0-1ubuntu2
libjavascriptcoregtk-4.0-18 on Ubuntu 20.04 LTS (focal)
libjavascriptcoregtk-4.0-bin 2.28.0-0ubuntu0.18.04.3
libjavascriptcoregtk-4.0-bin on Ubuntu 18.04.6 LTS (bionic)
libjavascriptcoregtk-4.0-bin 2.28.0-1ubuntu2
libjavascriptcoregtk-4.0-bin on Ubuntu 20.04 LTS (focal)

Vendor advisory

https://access.redhat.com/errata/RHSA-2020:4451

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo