Linux · Security advisory · May 22, 2024

RHSA-2024:2982: Security update for 4 packages

RHSA-2024:2982, released May 22, 2024, fixes 12 CVEs across 4 products. 2 of them are being exploited (CVE-2023-42917); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV

CVEs closed

None rated Critical

Exploited

CVE-2023-42917

Exploitation more likely

Vendor assessment

Highest EPSS

0.0930

95th percentile

Priority of the 12 CVEs

Patch now 2
                                Urgent 0
                                High 8
                                Routine 2

Fixed package versions

Product	Release	Fixed in
webkit2gtk3	RHEL 8	0:2.42.5-1.el8
webkit2gtk3-devel	RHEL 8	0:2.42.5-1.el8
webkit2gtk3-jsc	RHEL 8	0:2.42.5-1.el8
webkit2gtk3-jsc-devel	RHEL 8	0:2.42.5-1.el8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2023-42917	webkit2gtk: A memory corruption vulnerability was addressed with improved locking	8.8	0.0930	KEVExploited
Patch now	CVE-2023-43000	webkit2gtk3: This update for webkit2gtk3 fixes the following issues: Update to version 2.50.4. Security issues fixed: - CVE-202...	8.8	0.0404	KEVExploited
High	CVE-2023-42890	webkit2gtk: The issue was addressed with improved memory handling	8.8	0.0321	None reported
High	CVE-2023-42852	webkit2gtk: A logic issue was addressed with improved checks	8.8	0.0198	None reported
High	CVE-2014-1745	webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgt...	7.1	0.0168	None reported
High	CVE-2023-39928	webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgt...	8.8	0.0145	None reported
High	CVE-2023-40414	webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgt...	9.8	0.0115	None reported
High	CVE-2023-32359	webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgt...	7.5	0.0113	None reported
High	CVE-2023-42970	webkit2gtk3: This update for webkit2gtk3 fixes the following issues: Update to version 2.48.2. Security issues fixed: - CVE-202...	8.8	0.0057	None reported
High	CVE-2023-42875	webkit2gtk3: This update for webkit2gtk3 fixes the following issues: Update to version 2.48.2. Security issues fixed: - CVE-202...	8.8	0.0056	None reported
Routine	CVE-2023-41983	webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgt...	6.5	0.0149	None reported
Routine	CVE-2023-42883	webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgt...	5.5	0.0072	None reported

Also fixes CVE-2023-42917

gir1.2-javascriptcoregtk-4.0 2.42.3-0ubuntu0.22.04.1
gir1.2-javascriptcoregtk-4.0 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-javascriptcoregtk-4.0 2.42.3-1
gir1.2-javascriptcoregtk-4.0 on Ubuntu 24.04.5 LTS (noble)
gir1.2-javascriptcoregtk-4.1 2.42.3-0ubuntu0.22.04.1
gir1.2-javascriptcoregtk-4.1 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-javascriptcoregtk-4.1 2.42.3-1
gir1.2-javascriptcoregtk-4.1 on Ubuntu 24.04.5 LTS (noble)
gir1.2-javascriptcoregtk-6.0 2.42.3-0ubuntu0.22.04.1
gir1.2-javascriptcoregtk-6.0 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-javascriptcoregtk-6.0 2.42.3-1
gir1.2-javascriptcoregtk-6.0 on Ubuntu 24.04.5 LTS (noble)
gir1.2-webkit-6.0 2.42.3-0ubuntu0.22.04.1
gir1.2-webkit-6.0 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-webkit-6.0 2.42.3-1
gir1.2-webkit-6.0 on Ubuntu 24.04.5 LTS (noble)

Vendor advisory

https://access.redhat.com/errata/RHSA-2024:2982

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo