ELSA-2021-4381: Security update for 57 packages

ELSA-2021-4381, released November 16, 2021, fixes 29 CVEs across 57 products. 5 of them are being exploited (CVE-2021-1789); 5 on CISA KEV. Patch Radar priority: Patch now.

Patch now5 on CISA KEV

CVEs closed

None rated Critical

Exploited

CVE-2021-1789

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.1398

96th percentile

Priority of the 29 CVEs

Patch now 5
                                Urgent 0
                                High 17
                                Routine 7

Fixed package versions

Product	Release	Fixed in
LibRaw	ol 8	0:0.19.5-3.el8
LibRaw-devel	ol 8	0:0.19.5-3.el8
accountsservice	ol 8	0:0.6.55-2.el8
accountsservice-devel	ol 8	0:0.6.55-2.el8
accountsservice-libs	ol 8	0:0.6.55-2.el8
gdm	ol 8	1:40.0-15.el8
gnome-autoar	ol 8	0:0.2.3-2.el8
gnome-calculator	ol 8	0:3.28.2-2.el8
gnome-classic-session	ol 8	0:3.32.1-20.el8
gnome-control-center	ol 8	0:3.28.2-28.el8
gnome-control-center-filesystem	ol 8	0:3.28.2-28.el8
gnome-online-accounts	ol 8	0:3.28.2-3.el8
gnome-online-accounts-devel	ol 8	0:3.28.2-3.el8
gnome-session	ol 8	0:3.28.1-13.0.1.el8
gnome-session-kiosk-session	ol 8	0:3.28.1-13.0.1.el8
gnome-session-wayland-session	ol 8	0:3.28.1-13.0.1.el8
gnome-session-xsession	ol 8	0:3.28.1-13.0.1.el8
gnome-settings-daemon	ol 8	0:3.32.0-16.el8
gnome-shell	ol 8	0:3.32.2-40.el8
gnome-shell-extension-apps-menu	ol 8	0:3.32.1-20.el8
gnome-shell-extension-auto-move-windows	ol 8	0:3.32.1-20.el8
gnome-shell-extension-common	ol 8	0:3.32.1-20.el8
gnome-shell-extension-dash-to-dock	ol 8	0:3.32.1-20.el8
gnome-shell-extension-desktop-icons	ol 8	0:3.32.1-20.el8
gnome-shell-extension-disable-screenshield	ol 8	0:3.32.1-20.el8
gnome-shell-extension-drive-menu	ol 8	0:3.32.1-20.el8
gnome-shell-extension-gesture-inhibitor	ol 8	0:3.32.1-20.el8
gnome-shell-extension-horizontal-workspaces	ol 8	0:3.32.1-20.el8
gnome-shell-extension-launch-new-instance	ol 8	0:3.32.1-20.el8
gnome-shell-extension-native-window-placement	ol 8	0:3.32.1-20.el8
gnome-shell-extension-no-hot-corner	ol 8	0:3.32.1-20.el8
gnome-shell-extension-panel-favorites	ol 8	0:3.32.1-20.el8
gnome-shell-extension-places-menu	ol 8	0:3.32.1-20.el8
gnome-shell-extension-screenshot-window-sizer	ol 8	0:3.32.1-20.el8
gnome-shell-extension-systemMonitor	ol 8	0:3.32.1-20.el8
gnome-shell-extension-top-icons	ol 8	0:3.32.1-20.el8
gnome-shell-extension-updates-dialog	ol 8	0:3.32.1-20.el8
gnome-shell-extension-user-theme	ol 8	0:3.32.1-20.el8
gnome-shell-extension-window-grouper	ol 8	0:3.32.1-20.el8
gnome-shell-extension-window-list	ol 8	0:3.32.1-20.el8
gnome-shell-extension-windowsNavigator	ol 8	0:3.32.1-20.el8
gnome-shell-extension-workspace-indicator	ol 8	0:3.32.1-20.el8
gnome-software	ol 8	0:3.36.1-10.el8
gnome-software-devel	ol 8	0:3.36.1-10.el8
gsettings-desktop-schemas	ol 8	0:3.32.0-6.el8
gsettings-desktop-schemas-devel	ol 8	0:3.32.0-6.el8
gtk-update-icon-cache	ol 8	0:3.22.30-8.el8
gtk3	ol 8	0:3.22.30-8.el8
gtk3-devel	ol 8	0:3.22.30-8.el8
gtk3-immodule-xim	ol 8	0:3.22.30-8.el8
mutter	ol 8	0:3.32.2-60.el8
mutter-devel	ol 8	0:3.32.2-60.el8
vino	ol 8	0:3.22.0-11.el8
webkit2gtk3	ol 8	0:2.32.3-2.el8
webkit2gtk3-devel	ol 8	0:2.32.3-2.el8
webkit2gtk3-jsc	ol 8	0:2.32.3-2.el8
webkit2gtk3-jsc-devel	ol 8	0:2.32.3-2.el8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2021-1789	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.1398	KEVExploited
Patch now	CVE-2021-1870	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	9.8	0.0771	KEVExploited
Patch now	CVE-2021-1871	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	9.8	0.0700	KEVExploited
Patch now	CVE-2021-30665	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0371	KEVExploited
Patch now	CVE-2021-30663	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0352	KEVExploited
High	CVE-2021-21779	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0292	None reported
High	CVE-2021-21806	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0284	None reported
High	CVE-2021-1844	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0238	None reported
High	CVE-2021-30799	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0226	None reported
High	CVE-2021-30795	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0222	None reported
High	CVE-2021-30734	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0202	None reported
High	CVE-2021-30797	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0187	None reported
High	CVE-2020-13558	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0186	None reported
High	CVE-2021-30749	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0168	None reported
High	CVE-2021-1788	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0168	None reported
High	CVE-2021-30758	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0166	None reported
High	CVE-2020-24870	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0163	None reported
High	CVE-2020-27918	iTunes: A use after free issue was addressed with improved memory management.	7.8	0.0143	None reported
High	CVE-2021-30720	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	9.3	0.0137	None reported
High	CVE-2021-21775	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0127	None reported
High	CVE-2021-30744	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.1	0.0116	None reported
High	CVE-2021-30689	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.1	0.0110	None reported
Routine	CVE-2021-1799	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	6.5	0.0176	None reported
Routine	CVE-2021-30682	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	6.5	0.0167	None reported
Routine	CVE-2021-1801	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	6.5	0.0152	None reported

Also fixes CVE-2021-1789

RHSA-2021:4381
LibRaw, LibRaw-devel, gnome-autoar and 4 more on RHEL 8
gir1.2-javascriptcoregtk-4.0 2.30.6-0ubuntu0.18.04.1
gir1.2-javascriptcoregtk-4.0 on Ubuntu 18.04.6 LTS (bionic)
gir1.2-javascriptcoregtk-4.0 2.30.6-0ubuntu0.20.04.1
gir1.2-javascriptcoregtk-4.0 on Ubuntu 20.04 LTS (focal)
gir1.2-webkit2-4.0 2.30.6-0ubuntu0.18.04.1
gir1.2-webkit2-4.0 on Ubuntu 18.04.6 LTS (bionic)
gir1.2-webkit2-4.0 2.30.6-0ubuntu0.20.04.1
gir1.2-webkit2-4.0 on Ubuntu 20.04 LTS (focal)
libjavascriptcoregtk-4.0-18 2.30.6-0ubuntu0.18.04.1
libjavascriptcoregtk-4.0-18 on Ubuntu 18.04.6 LTS (bionic)
libjavascriptcoregtk-4.0-18 2.30.6-0ubuntu0.20.04.1
libjavascriptcoregtk-4.0-18 on Ubuntu 20.04 LTS (focal)
libjavascriptcoregtk-4.0-bin 2.30.6-0ubuntu0.18.04.1
libjavascriptcoregtk-4.0-bin on Ubuntu 18.04.6 LTS (bionic)

Vendor advisory

https://linux.oracle.com/errata/ELSA-2021-4381.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/elsa-2021-4381">ELSA-2021-4381 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.