[SECURITY] Fedora 40 Update: libgsf-1.14.53-1.fc40
[SECURITY] Fedora 40 Update: webkit2gtk4.0-2.46.1-2.fc40
[SECURITY] Fedora 39 Update: libgsf-1.14.53-1.fc39
[SECURITY] Fedora 40 Update: libgsf-1.14.53-1.fc40
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-2ac7273bab
2024-10-14 01:56:03.000407
--------------------------------------------------------------------------------
Name : libgsf
Product : Fedora 40
Version : 1.14.53
Release : 1.fc40
URL : https://gitlab.gnome.org/GNOME/libgsf/
Summary : GNOME Structured File library
Description :
A library for reading and writing structured files (e.g. MS OLE and Zip)
--------------------------------------------------------------------------------
Update Information:
Fixes for memory vulnerabilities.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 11 2024 Gwyn Ciesla [gwync@protonmail.com] - 1.14.53-1
- 1.14.53
* Thu Jul 18 2024 Fedora Release Engineering [releng@fedoraproject.org] - 1.14.52-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Fri May 31 2024 Gwyn Ciesla [gwync@protonmail.com] - 1.14.52-1
- 1.14.52
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2317953 - (CVE-2024-42415) - CVE-2024-42415 libgsf: Compound Document Binary File Sector Allocation Table integer overflow vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2317953
[ 2 ] Bug #2317954 - (CVE-2024-36474) - CVE-2024-36474 libgsf: Compound Document Binary File Directory integer overflow vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2317954
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-2ac7273bab' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 40 Update: webkit2gtk4.0-2.46.1-2.fc40
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-9694c3eec0
2024-10-14 01:56:03.000258
--------------------------------------------------------------------------------
Name : webkit2gtk4.0
Product : Fedora 40
Version : 2.46.1
Release : 2.fc40
URL : https://www.webkitgtk.org/
Summary : WebKitGTK for GTK 3 and libsoup 2
Description :
WebKitGTK is the port of the WebKit web rendering engine to the
GTK platform. This package contains WebKitGTK for GTK 3 and libsoup 2.
--------------------------------------------------------------------------------
Update Information:
Update to 2.46.1
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 3 2024 Michael Catanzaro [mcatanzaro@redhat.com] - 2.46.1-2
- Add patch to fix build with LLVM 19
* Tue Oct 1 2024 Pete Walter [pwalter@fedoraproject.org] - 2.46.1-1
- Update to 2.46.1
* Tue Oct 1 2024 Pete Walter [pwalter@fedoraproject.org] - 2.46.0-2
- Add missing sysprof-capture-4 BuildRequires
* Wed Sep 18 2024 Pete Walter [pwalter@fedoraproject.org] - 2.46.0-1
- Update to 2.46.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2314731 - CVE-2024-44187 webkit2gtk4.0: A malicious website may exfiltrate data cross-origin [fedora-40]
https://bugzilla.redhat.com/show_bug.cgi?id=2314731
[ 2 ] Bug #2314733 - CVE-2024-40857 webkit2gtk4.0: Processing maliciously crafted web content may lead to universal cross site scripting [fedora-40]
https://bugzilla.redhat.com/show_bug.cgi?id=2314733
[ 3 ] Bug #2314743 - CVE-2024-27851 webkit2gtk4.0: Processing maliciously crafted web content may lead to arbitrary code execution [fedora-40]
https://bugzilla.redhat.com/show_bug.cgi?id=2314743
[ 4 ] Bug #2314747 - CVE-2024-23271 webkit2gtk4.0: A malicious website may cause unexpected cross-origin behavior [fedora-40]
https://bugzilla.redhat.com/show_bug.cgi?id=2314747
[ 5 ] Bug #2314749 - CVE-2024-27838 webkit2gtk4.0: A maliciously crafted webpage may be able to fingerprint the user [fedora-40]
https://bugzilla.redhat.com/show_bug.cgi?id=2314749
[ 6 ] Bug #2314752 - CVE-2024-27833 webkit2gtk4.0: Processing maliciously crafted web content may lead to arbitrary code execution [fedora-40]
https://bugzilla.redhat.com/show_bug.cgi?id=2314752
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-9694c3eec0' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 39 Update: libgsf-1.14.53-1.fc39
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-7d06f67cf5
2024-10-14 01:42:13.586266
--------------------------------------------------------------------------------
Name : libgsf
Product : Fedora 39
Version : 1.14.53
Release : 1.fc39
URL : https://gitlab.gnome.org/GNOME/libgsf/
Summary : GNOME Structured File library
Description :
A library for reading and writing structured files (e.g. MS OLE and Zip)
--------------------------------------------------------------------------------
Update Information:
Fixes for memory vulnerabilities.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 11 2024 Gwyn Ciesla [gwync@protonmail.com] - 1.14.53-1
- 1.14.53
* Thu Jul 18 2024 Fedora Release Engineering [releng@fedoraproject.org] - 1.14.52-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Fri May 31 2024 Gwyn Ciesla [gwync@protonmail.com] - 1.14.52-1
- 1.14.52
* Thu Jan 25 2024 Fedora Release Engineering [releng@fedoraproject.org] - 1.14.51-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering [releng@fedoraproject.org] - 1.14.51-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Thu Nov 30 2023 David King [amigadave@amigadave.com] - 1.14.51-2
- Fix building against libxml 2.12.0
- Use pkgconfig for BuildRequires
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2317953 - (CVE-2024-42415) - CVE-2024-42415 libgsf: Compound Document Binary File Sector Allocation Table integer overflow vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2317953
[ 2 ] Bug #2317954 - (CVE-2024-36474) - CVE-2024-36474 libgsf: Compound Document Binary File Directory integer overflow vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2317954
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-7d06f67cf5' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
