RHSA-2020:4451: Security update for 7 packages

RHSA-2020:4451, released November 4, 2020, fixes 57 CVEs across 7 products. 4 of them are being exploited (CVE-2021-30762); 4 on CISA KEV. Patch Radar priority: Patch now.

Patch now4 on CISA KEV

CVEs closed

None rated Critical

Exploited

CVE-2021-30762

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.7740

99th percentile

Priority of the 57 CVEs

Patch now 4
                                Urgent 0
                                High 41
                                Routine 12

Fixed package versions

Product	Release	Fixed in
LibRaw	RHEL 8	0:0.19.5-2.el8
LibRaw-devel	RHEL 8	0:0.19.5-2.el8
gnome-settings-daemon	RHEL 8	0:3.32.0-11.el8
webkit2gtk3	RHEL 8	0:2.28.4-1.el8
webkit2gtk3-devel	RHEL 8	0:2.28.4-1.el8
webkit2gtk3-jsc	RHEL 8	0:2.28.4-1.el8
webkit2gtk3-jsc-devel	RHEL 8	0:2.28.4-1.el8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2021-30762	gnome-settings-daemon: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.1099	KEVExploited
Patch now	CVE-2021-30761	gnome-settings-daemon: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.1055	KEVExploited
Patch now	CVE-2021-30666	gnome-settings-daemon: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0297	KEVExploited
Patch now	CVE-2019-8720	webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0156	KEVExploited
High	CVE-2020-9850	iTunes: A logic issue was addressed with improved restrictions.	9.8	0.7740	None reported
High	CVE-2019-8820	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0962	None reported
High	CVE-2020-9802	iTunes: A logic issue was addressed with improved restrictions.	8.8	0.0883	None reported
High	CVE-2020-10018	webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	7.5	0.0499	None reported
High	CVE-2020-9895	iTunes: A use after free issue was addressed with improved memory management.	9.8	0.0449	None reported
High	CVE-2020-3897	iTunes: A type confusion issue was addressed with improved memory handling.	8.8	0.0448	None reported
High	CVE-2020-3899	iTunes: A memory consumption issue was addressed with improved memory handling.	8.8	0.0412	None reported
High	CVE-2020-15503	webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	7.5	0.0330	None reported
High	CVE-2020-9893	iTunes: A use after free issue was addressed with improved memory management.	8.8	0.0295	None reported
High	CVE-2020-11793	webkit2gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0290	None reported
High	CVE-2020-9894	iTunes: An out-of-bounds read was addressed with improved input validation.	9.8	0.0284	None reported
High	CVE-2020-3868	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0270	None reported
High	CVE-2020-3895	iTunes: A memory corruption issue was addressed with improved memory handling.	8.8	0.0267	None reported
High	CVE-2019-8816	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0258	None reported
High	CVE-2019-8814	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0254	None reported
High	CVE-2019-8815	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0229	None reported
High	CVE-2019-8846	iTunes: A use after free issue was addressed with improved memory management.	8.8	0.0224	None reported
High	CVE-2019-8844	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0218	None reported
High	CVE-2019-8835	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0202	None reported
High	CVE-2019-8811	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0200	None reported
High	CVE-2019-8783	iTunes: Multiple memory corruption issues were addressed with improved memory handling.	8.8	0.0195	None reported

Also fixes CVE-2021-30762

gir1.2-javascriptcoregtk-4.0 2.28.0-0ubuntu0.18.04.3
gir1.2-javascriptcoregtk-4.0 on Ubuntu 18.04.6 LTS (bionic)
gir1.2-javascriptcoregtk-4.0 2.28.0-1ubuntu2
gir1.2-javascriptcoregtk-4.0 on Ubuntu 20.04 LTS (focal)
gir1.2-webkit2-4.0 2.28.0-0ubuntu0.18.04.3
gir1.2-webkit2-4.0 on Ubuntu 18.04.6 LTS (bionic)
gir1.2-webkit2-4.0 2.28.0-1ubuntu2
gir1.2-webkit2-4.0 on Ubuntu 20.04 LTS (focal)
libjavascriptcoregtk-4.0-18 2.28.0-0ubuntu0.18.04.3
libjavascriptcoregtk-4.0-18 on Ubuntu 18.04.6 LTS (bionic)
libjavascriptcoregtk-4.0-18 2.28.0-1ubuntu2
libjavascriptcoregtk-4.0-18 on Ubuntu 20.04 LTS (focal)
libjavascriptcoregtk-4.0-bin 2.28.0-0ubuntu0.18.04.3
libjavascriptcoregtk-4.0-bin on Ubuntu 18.04.6 LTS (bionic)
libjavascriptcoregtk-4.0-bin 2.28.0-1ubuntu2
libjavascriptcoregtk-4.0-bin on Ubuntu 20.04 LTS (focal)

Vendor advisory

https://access.redhat.com/errata/RHSA-2020:4451

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/rhsa-2020-4451">RHSA-2020:4451 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.