Linux · Red Hat · Security advisory · November 14, 2024

RHSA-2024:9636: Security update for 4 packages

RHSA-2024:9636, released November 14, 2024, fixes 21 CVEs across 4 products. One of them is being exploited (CVE-2024-27834); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
21
None rated Critical
Exploited
1
CVE-2024-27834
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0153
74th percentile

Priority of the 21 CVEs

Patch now 1 Urgent 0 High 9 Routine 11

Fixed package versions

ProductReleaseFixed in
webkit2gtk3RHEL 80:2.46.3-1.el8_10
webkit2gtk3-develRHEL 80:2.46.3-1.el8_10
webkit2gtk3-jscRHEL 80:2.46.3-1.el8_10
webkit2gtk3-jsc-develRHEL 80:2.46.3-1.el8_10

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2024-27834 WebKit: An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication8.8 0.0150 KEVExploited
High CVE-2024-4558 Chromium: CVE-2024-4558 Use after free in ANGLE9.6 0.0153 None reported
High CVE-2023-42950 webkit2gtk3: This update for webkit2gtk3 fixes the following issues: - Update to version 2.44.2 (bsc#1225071): - CVE-2024-23252:...8.8 0.0107 None reported
High CVE-2024-54534 WebKit: Processing maliciously crafted web content may lead to memory corruption9.8 0.0105 None reported
High CVE-2024-27820 WebKit Web Inspector: Processing web content may lead to arbitrary code execution8.8 0.0102 None reported
High CVE-2023-43010 webkit2gtk3: This update for webkit2gtk3 fixes the following issues: Update to version 2.52.0. Security issues fixed: - CVE...8.8 0.0097 None reported
High CVE-2024-27851 WebKit: Processing maliciously crafted web content may lead to arbitrary code execution8.8 0.0082 None reported
High CVE-2024-23271 Unknown7.3 0.0080 None reported
High CVE-2024-27856 WebKit: Processing a file may lead to unexpected app termination or arbitrary code execution8.8 0.0060 None reported
High CVE-2025-43480 WebKit: A malicious website may exfiltrate data cross-origin8.8 0.0049 None reported
Routine CVE-2024-40789 WebKit: Processing maliciously crafted web content may lead to an unexpected process crash6.5 0.0115 None reported
Routine CVE-2024-40782 gir1.2-webkit2-4.0: A use-after-free issue was addressed with improved memory management6.5 0.0098 None reported
Routine CVE-2024-44244 WebKit: Processing maliciously crafted web content may lead to an unexpected process crash4.3 0.0096 None reported
Routine CVE-2024-40866 WebKit: Visiting a malicious website may lead to address bar spoofing6.5 0.0093 None reported
Routine CVE-2024-27838 WebKit: A maliciously crafted webpage may be able to fingerprint the user6.5 0.0073 None reported
Routine CVE-2024-40780 webkit2gtk-driver: An out-of-bounds read was addressed with improved bounds checking6.5 0.0070 None reported
Routine CVE-2024-44296 WebKit: Processing maliciously crafted web content may prevent Content Security Policy from being enforced5.4 0.0066 None reported
Routine CVE-2024-44187 WebKit: A malicious website may exfiltrate data cross-origin6.5 0.0065 None reported
Routine CVE-2024-54658 WebKit: Processing web content may lead to a denial-of-service6.5 0.0054 None reported
Routine CVE-2024-40779 WebKit: Processing maliciously crafted web content may lead to an unexpected process crash6.5 0.0034 None reported
Routine CVE-2024-44185 WebKit: Processing maliciously crafted web content may lead to an unexpected process crash5.5 0.0029 None reported
Showing 1 to 21 of 21 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.