SUSE update for webkit2gtk3
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 9 |
| CVE-ID | CVE-2022-42852 CVE-2022-42856 CVE-2022-42863 CVE-2022-42867 CVE-2022-46691 CVE-2022-46692 CVE-2022-46698 CVE-2022-46699 CVE-2022-46700 |
| CWE-ID | CWE-125 CWE-843 CWE-119 CWE-254 CWE-200 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #2 is being exploited in the wild. |
| Vulnerable software |
SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE CaaS Platform Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system libwebkit2gtk3-lang Operating systems & Components / Operating system package or component webkit2gtk3-devel Operating systems & Components / Operating system package or component webkit2gtk3-debugsource Operating systems & Components / Operating system package or component webkit2gtk-4_0-injected-bundles-debuginfo Operating systems & Components / Operating system package or component webkit2gtk-4_0-injected-bundles Operating systems & Components / Operating system package or component typelib-1_0-WebKit2WebExtension-4_0 Operating systems & Components / Operating system package or component typelib-1_0-WebKit2-4_0 Operating systems & Components / Operating system package or component typelib-1_0-JavaScriptCore-4_0 Operating systems & Components / Operating system package or component libwebkit2gtk-4_0-37-debuginfo Operating systems & Components / Operating system package or component libwebkit2gtk-4_0-37 Operating systems & Components / Operating system package or component libjavascriptcoregtk-4_0-18-debuginfo Operating systems & Components / Operating system package or component libjavascriptcoregtk-4_0-18 Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 9 vulnerabilities.
1) Out-of-bounds read
EUVDB-ID: #VU70238
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-42852
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim to visit a specially crafted web page, trigger an out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Type Confusion
EUVDB-ID: #VU70195
Risk: Critical
CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]
CVE-ID: CVE-2022-42856
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim to visit a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
Update the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
3) Buffer overflow
EUVDB-ID: #VU70242
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-42863
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Buffer overflow
EUVDB-ID: #VU70234
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-42867
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Buffer overflow
EUVDB-ID: #VU70235
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-46691
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
MitigationUpdate the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Security features bypass
EUVDB-ID: #VU70236
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-46692
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a logic issue in WebKit. A remote attacker can trick the victim to visit a specially crafted web page and bypass Same Origin Policy.
MitigationUpdate the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Information disclosure
EUVDB-ID: #VU70243
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-46698
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in WebKit. A remote attacker can gain unauthorized access to sensitive information on the system.
MitigationUpdate the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Buffer overflow
EUVDB-ID: #VU70241
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-46699
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Buffer overflow
EUVDB-ID: #VU70240
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-46700
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package webkit2gtk3 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-LTSS
libwebkit2gtk3-lang: before 2.38.3-150000.3.125.1
webkit2gtk3-devel: before 2.38.3-150000.3.125.1
webkit2gtk3-debugsource: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles-debuginfo: before 2.38.3-150000.3.125.1
webkit2gtk-4_0-injected-bundles: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2WebExtension-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-WebKit2-4_0: before 2.38.3-150000.3.125.1
typelib-1_0-JavaScriptCore-4_0: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37-debuginfo: before 2.38.3-150000.3.125.1
libwebkit2gtk-4_0-37: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18-debuginfo: before 2.38.3-150000.3.125.1
libjavascriptcoregtk-4_0-18: before 2.38.3-150000.3.125.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libwebkit2gtk3-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk3-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:webkit2gtk-4_0-injected-bundles:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2webextension-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-webkit2-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-javascriptcore-4_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libwebkit2gtk-4_0-37:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libjavascriptcoregtk-4_0-18:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2022/suse-su-20224642-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
