webkitgtk-2.38.3

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

Release Notes

What’s new in the WebKitGTK 2.38.3 release?

    Fix runtime critical warnings from media player.
    Fix network process crash when fetching website data on ephemeral session.
    Fix the build with Ruby 3.2.
    Fix several crashes and rendering issues.

Security Advisory

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

    CVE-2022-42852
        Versions affected: WebKitGTK and WPE WebKit before 2.38.3.
        Credit to hazbinhotel working with Trend Micro Zero Day Initiative.
        Impact: Processing maliciously crafted web content may result in the disclosure 
                of process memory. 
        Description: The issue was addressed with improved memory handling.

    CVE-2022-42856
        Versions affected: WebKitGTK and WPE WebKit before 2.38.3.
        Credit to Clément Lecigne of Google’s Threat Analysis Group.
        Impact: Processing maliciously crafted web content may lead to arbitrary code 
                execution. 
        Description: A type confusion issue was addressed with improved state handling.

    CVE-2022-42863
        Versions affected: WebKitGTK and WPE WebKit before 2.38.0.
        Credit to an anonymous researcher.
        Impact: Processing maliciously crafted web content may lead to arbitrary code 
                execution. 
        Description: A memory corruption issue was addressed with improved state 
                     management.

    CVE-2022-42867
        Versions affected: WebKitGTK and WPE WebKit before 2.38.3.
        Credit to Maddie Stone of Google Project Zero.
        Impact: Processing maliciously crafted web content may lead to arbitrary code 
                execution. 
        Description: A use after free issue was addressed with improved memory 
                     management.

    CVE-2022-46691
        Versions affected: WebKitGTK and WPE WebKit before 2.38.1.
        Credit to an anonymous researcher.
        Impact: Processing maliciously crafted web content may lead to arbitrary code 
                execution. 
        Description: A memory consumption issue was addressed with improved memory 
                     handling.

    CVE-2022-46692
        Versions affected: WebKitGTK and WPE WebKit before 2.38.3.
        Credit to KirtiKumar Anandrao Ramchandani.
        Impact: Processing maliciously crafted web content may bypass Same Origin 
                Policy. 
        Description: A logic issue was addressed with improved state management.

    CVE-2022-46698
        Versions affected: WebKitGTK and WPE WebKit before 2.38.3.
        Credit to Dohyun Lee (@l33d0hyun) of DNSLab at Korea University, Ryan Shin of IAAI SecLab at Korea University.
        Impact: Processing maliciously crafted web content may disclose sensitive user 
                information. 
        Description: A logic issue was addressed with improved checks.

    CVE-2022-46699
        Versions affected: WebKitGTK and WPE WebKit before 2.38.3.
        Credit to Samuel Groß of Google V8 Security.
        Impact: Processing maliciously crafted web content may lead to arbitrary code 
                execution. 
        Description: A memory corruption issue was addressed with improved state 
                     management.

    CVE-2022-46700
        Versions affected: WebKitGTK and WPE WebKit before 2.38.3.
        Credit to Samuel Groß of Google V8 Security.
        Impact: Processing maliciously crafted web content may lead to arbitrary code
                execution.
        Description: A memory corruption issue was addressed with improved inpu
                     validation.

[Douglas R. Reno]

Fixed at 7d2754437c7a5b6d20e989ed1ba5ab01d1718fff

Security advisory to come after the new year.

[Douglas R. Reno]

SA-11.2-068 issued