Linux · Oracle Linux · Security advisory · November 10, 2020

ELSA-2020-4451: Security update for 97 packages

ELSA-2020-4451, released November 10, 2020, fixes 53 CVEs across 97 products. One of them is being exploited (CVE-2019-8720); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
53
None rated Critical
Exploited
1
CVE-2019-8720
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.7740
99th percentile

Priority of the 53 CVEs

Patch now 1 Urgent 0 High 40 Routine 12

Fixed package versions

ProductReleaseFixed in
LibRawol 80:0.19.5-2.el8
LibRaw-develol 80:0.19.5-2.el8
PackageKitol 80:1.1.12-6.0.1.el8
PackageKit-command-not-foundol 80:1.1.12-6.0.1.el8
PackageKit-cronol 80:1.1.12-6.0.1.el8
PackageKit-glibol 80:1.1.12-6.0.1.el8
PackageKit-glib-develol 80:1.1.12-6.0.1.el8
PackageKit-gstreamer-pluginol 80:1.1.12-6.0.1.el8
PackageKit-gtk3-moduleol 80:1.1.12-6.0.1.el8
dleyna-rendererol 80:0.6.0-3.el8
frei0r-develol 80:1.6.1-7.el8
frei0r-pluginsol 80:1.6.1-7.el8
frei0r-plugins-opencvol 80:1.6.1-7.el8
gdmol 81:3.28.3-34.el8
gnome-classic-sessionol 80:3.32.1-11.el8
gnome-control-centerol 80:3.28.2-22.el8
gnome-control-center-filesystemol 80:3.28.2-22.el8
gnome-photosol 80:3.28.1-3.el8
gnome-photos-testsol 80:3.28.1-3.el8
gnome-remote-desktopol 80:0.1.8-3.el8
gnome-sessionol 80:3.28.1-10.0.1.el8
gnome-session-wayland-sessionol 80:3.28.1-10.0.1.el8
gnome-session-xsessionol 80:3.28.1-10.0.1.el8
gnome-settings-daemonol 80:3.32.0-11.el8
gnome-shellol 80:3.32.2-20.el8
gnome-shell-extension-apps-menuol 80:3.32.1-11.el8
gnome-shell-extension-auto-move-windowsol 80:3.32.1-11.el8
gnome-shell-extension-commonol 80:3.32.1-11.el8
gnome-shell-extension-dash-to-dockol 80:3.32.1-11.el8
gnome-shell-extension-desktop-iconsol 80:3.32.1-11.el8
gnome-shell-extension-disable-screenshieldol 80:3.32.1-11.el8
gnome-shell-extension-drive-menuol 80:3.32.1-11.el8
gnome-shell-extension-horizontal-workspacesol 80:3.32.1-11.el8
gnome-shell-extension-launch-new-instanceol 80:3.32.1-11.el8
gnome-shell-extension-native-window-placementol 80:3.32.1-11.el8
gnome-shell-extension-no-hot-cornerol 80:3.32.1-11.el8
gnome-shell-extension-panel-favoritesol 80:3.32.1-11.el8
gnome-shell-extension-places-menuol 80:3.32.1-11.el8
gnome-shell-extension-screenshot-window-sizerol 80:3.32.1-11.el8
gnome-shell-extension-systemMonitorol 80:3.32.1-11.el8
gnome-shell-extension-top-iconsol 80:3.32.1-11.el8
gnome-shell-extension-updates-dialogol 80:3.32.1-11.el8
gnome-shell-extension-user-themeol 80:3.32.1-11.el8
gnome-shell-extension-window-grouperol 80:3.32.1-11.el8
gnome-shell-extension-window-listol 80:3.32.1-11.el8
gnome-shell-extension-windowsNavigatorol 80:3.32.1-11.el8
gnome-shell-extension-workspace-indicatorol 80:3.32.1-11.el8
gnome-terminalol 80:3.28.3-2.el8
gnome-terminal-nautilusol 80:3.28.3-2.el8
gsettings-desktop-schemasol 80:3.32.0-5.el8
gsettings-desktop-schemas-develol 80:3.32.0-5.el8
gtk-docol 80:1.28-2.el8
gtk-update-icon-cacheol 80:3.22.30-6.el8
gtk3ol 80:3.22.30-6.el8
gtk3-develol 80:3.22.30-6.el8
gtk3-immodule-ximol 80:3.22.30-6.el8
gvfsol 80:1.36.2-10.el8
gvfs-afcol 80:1.36.2-10.el8
gvfs-afpol 80:1.36.2-10.el8
gvfs-archiveol 80:1.36.2-10.el8
gvfs-clientol 80:1.36.2-10.el8
gvfs-develol 80:1.36.2-10.el8
gvfs-fuseol 80:1.36.2-10.el8
gvfs-goaol 80:1.36.2-10.el8
gvfs-gphoto2ol 80:1.36.2-10.el8
gvfs-mtpol 80:1.36.2-10.el8
gvfs-smbol 80:1.36.2-10.el8
libsoupol 80:2.62.3-2.el8
libsoup-develol 80:2.62.3-2.el8
mutterol 80:3.32.2-48.el8
mutter-develol 80:3.32.2-48.el8
nautilusol 80:3.28.1-14.el8
nautilus-develol 80:3.28.1-14.el8
nautilus-extensionsol 80:3.28.1-14.el8
pipewireol 80:0.3.6-1.el8
pipewire-develol 80:0.3.6-1.el8
pipewire-docol 80:0.3.6-1.el8
pipewire-libsol 80:0.3.6-1.el8
pipewire-utilsol 80:0.3.6-1.el8
pipewire0.2-develol 80:0.2.7-6.el8
pipewire0.2-libsol 80:0.2.7-6.el8
potraceol 80:1.15-3.el8
pygobject3-develol 80:3.28.3-2.el8
python3-gobjectol 80:3.28.3-2.el8
python3-gobject-baseol 80:3.28.3-2.el8
trackerol 80:2.1.5-2.el8
tracker-develol 80:2.1.5-2.el8
vte-profileol 80:0.52.4-2.el8
vte291ol 80:0.52.4-2.el8
vte291-develol 80:0.52.4-2.el8
webkit2gtk3ol 80:2.28.4-1.el8
webkit2gtk3-develol 80:2.28.4-1.el8
webkit2gtk3-jscol 80:2.28.4-1.el8
webkit2gtk3-jsc-develol 80:2.28.4-1.el8
webrtc-audio-processingol 80:0.3-9.el8
xdg-desktop-portalol 80:1.6.0-2.el8
xdg-desktop-portal-gtkol 80:1.6.0-1.el8

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2019-8720 webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...8.8 0.0156 KEVExploited
High CVE-2020-9850 iTunes: A logic issue was addressed with improved restrictions.9.8 0.7740 None reported
High CVE-2019-8820 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0962 None reported
High CVE-2020-9802 iTunes: A logic issue was addressed with improved restrictions.8.8 0.0883 None reported
High CVE-2020-10018 webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...7.5 0.0499 None reported
High CVE-2020-9895 iTunes: A use after free issue was addressed with improved memory management.9.8 0.0449 None reported
High CVE-2020-3897 iTunes: A type confusion issue was addressed with improved memory handling.8.8 0.0448 None reported
High CVE-2020-3899 iTunes: A memory consumption issue was addressed with improved memory handling.8.8 0.0412 None reported
High CVE-2020-15503 webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...7.5 0.0330 None reported
High CVE-2020-9893 iTunes: A use after free issue was addressed with improved memory management.8.8 0.0295 None reported
High CVE-2020-11793 webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...8.8 0.0290 None reported
High CVE-2020-9894 iTunes: An out-of-bounds read was addressed with improved input validation.9.8 0.0284 None reported
High CVE-2020-3868 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0270 None reported
High CVE-2020-3895 iTunes: A memory corruption issue was addressed with improved memory handling.8.8 0.0267 None reported
High CVE-2019-8816 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0258 None reported
High CVE-2019-8814 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0254 None reported
High CVE-2019-8815 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0229 None reported
High CVE-2019-8846 iTunes: A use after free issue was addressed with improved memory management.8.8 0.0224 None reported
High CVE-2019-8844 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0218 None reported
High CVE-2019-8835 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0202 None reported
High CVE-2019-8811 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0200 None reported
High CVE-2019-8783 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0195 None reported
High CVE-2020-9862 iTunes: A command injection issue existed in Web Inspector.7.8 0.0192 None reported
High CVE-2019-8819 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0192 None reported
High CVE-2019-8823 iTunes: Multiple memory corruption issues were addressed with improved memory handling.8.8 0.0192 None reported
Showing 1 to 25 of 53 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.