Security update for webkit2gtk3 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:3603-1 Final 1 1 2021-11-03T13:58:42Z current 2021-11-03T13:58:42Z 2021-11-03T13:58:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for webkit2gtk3 This update for webkit2gtk3 fixes the following issues: - CVE-2021-42762: Updated seccomp rules with latest changes from flatpak (bsc#1191937). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2021-3603 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VAIZQAAKIJLME5Z3MKND2JGJ5CQPRYZD/ E-Mail link for openSUSE-SU-2021:3603-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1191937 SUSE Bug 1191937 https://www.suse.com/security/cve/CVE-2021-42762/ SUSE CVE CVE-2021-42762 page openSUSE Leap 15.3 libjavascriptcoregtk-4_0-18-2.32.4-15.1 libjavascriptcoregtk-4_0-18-32bit-2.32.4-15.1 libwebkit2gtk-4_0-37-2.32.4-15.1 libwebkit2gtk-4_0-37-32bit-2.32.4-15.1 libwebkit2gtk3-lang-2.32.4-15.1 typelib-1_0-JavaScriptCore-4_0-2.32.4-15.1 typelib-1_0-WebKit2-4_0-2.32.4-15.1 typelib-1_0-WebKit2WebExtension-4_0-2.32.4-15.1 webkit-jsc-4-2.32.4-15.1 webkit2gtk-4_0-injected-bundles-2.32.4-15.1 webkit2gtk3-devel-2.32.4-15.1 webkit2gtk3-minibrowser-2.32.4-15.1 libjavascriptcoregtk-4_0-18-2.32.4-15.1 as a component of openSUSE Leap 15.3 libjavascriptcoregtk-4_0-18-32bit-2.32.4-15.1 as a component of openSUSE Leap 15.3 libwebkit2gtk-4_0-37-2.32.4-15.1 as a component of openSUSE Leap 15.3 libwebkit2gtk-4_0-37-32bit-2.32.4-15.1 as a component of openSUSE Leap 15.3 libwebkit2gtk3-lang-2.32.4-15.1 as a component of openSUSE Leap 15.3 typelib-1_0-JavaScriptCore-4_0-2.32.4-15.1 as a component of openSUSE Leap 15.3 typelib-1_0-WebKit2-4_0-2.32.4-15.1 as a component of openSUSE Leap 15.3 typelib-1_0-WebKit2WebExtension-4_0-2.32.4-15.1 as a component of openSUSE Leap 15.3 webkit-jsc-4-2.32.4-15.1 as a component of openSUSE Leap 15.3 webkit2gtk-4_0-injected-bundles-2.32.4-15.1 as a component of openSUSE Leap 15.3 webkit2gtk3-devel-2.32.4-15.1 as a component of openSUSE Leap 15.3 webkit2gtk3-minibrowser-2.32.4-15.1 as a component of openSUSE Leap 15.3 BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133. CVE-2021-42762 openSUSE Leap 15.3:libjavascriptcoregtk-4_0-18-2.32.4-15.1 openSUSE Leap 15.3:libjavascriptcoregtk-4_0-18-32bit-2.32.4-15.1 openSUSE Leap 15.3:libwebkit2gtk-4_0-37-2.32.4-15.1 openSUSE Leap 15.3:libwebkit2gtk-4_0-37-32bit-2.32.4-15.1 openSUSE Leap 15.3:libwebkit2gtk3-lang-2.32.4-15.1 openSUSE Leap 15.3:typelib-1_0-JavaScriptCore-4_0-2.32.4-15.1 openSUSE Leap 15.3:typelib-1_0-WebKit2-4_0-2.32.4-15.1 openSUSE Leap 15.3:typelib-1_0-WebKit2WebExtension-4_0-2.32.4-15.1 openSUSE Leap 15.3:webkit-jsc-4-2.32.4-15.1 openSUSE Leap 15.3:webkit2gtk-4_0-injected-bundles-2.32.4-15.1 openSUSE Leap 15.3:webkit2gtk3-devel-2.32.4-15.1 openSUSE Leap 15.3:webkit2gtk3-minibrowser-2.32.4-15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VAIZQAAKIJLME5Z3MKND2JGJ5CQPRYZD/ https://www.suse.com/security/cve/CVE-2021-42762.html CVE-2021-42762 https://bugzilla.suse.com/1191937 SUSE Bug 1191937