- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3961-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/               Emilio Pozuelo Monfort
November 22, 2024                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : webkit2gtk
Version        : 2.46.3-1~deb11u2
CVE ID         : CVE-2024-40866 CVE-2024-44185 CVE-2024-44187 CVE-2024-44244
                 CVE-2024-44296

The following vulnerabilities have been discovered in the WebKitGTK
web engine:

CVE-2024-40866

    Hafiizh and YoKo Kho discovered that visiting a malicious website
    may lead to address bar spoofing.

CVE-2024-44185

    Gary Kwong discovered that processing maliciously crafted web
    content may lead to an unexpected process crash.

CVE-2024-44187

    Narendra Bhati discovered that a malicious website may exfiltrate
    data cross-origin.

CVE-2024-44244

    An anonymous researcher, Q1IQ (@q1iqF) and P1umer discovered that
    processing maliciously crafted web content may lead to an
    unexpected process crash.

CVE-2024-44296

    Narendra Bhati discovered that processing maliciously crafted web
    content may prevent Content Security Policy from being enforced.

For Debian 11 bullseye, these problems have been fixed in version
2.46.3-1~deb11u2.

We recommend that you upgrade your webkit2gtk packages.

For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS