Security update for webkit2gtk3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1137-1 Final 1 1 2019-05-03T09:29:28Z current 2019-05-03T09:29:28Z 2019-05-03T09:29:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for webkit2gtk3 This update for webkit2gtk3 to version 2.24.1 fixes the following issues: Security issues fixed: - CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8518, CVE-2019-8523, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-1137,SUSE-SLE-Module-Basesystem-15-2019-1137,SUSE-SLE-Module-Desktop-Applications-15-2019-1137,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1137 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ Link for SUSE-SU-2019:1137-1 https://lists.suse.com/pipermail/sle-security-updates/2019-May/005420.html E-Mail link for SUSE-SU-2019:1137-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1132256 SUSE Bug 1132256 https://www.suse.com/security/cve/CVE-2019-11070/ SUSE CVE CVE-2019-11070 page https://www.suse.com/security/cve/CVE-2019-6201/ SUSE CVE CVE-2019-6201 page https://www.suse.com/security/cve/CVE-2019-6251/ SUSE CVE CVE-2019-6251 page https://www.suse.com/security/cve/CVE-2019-7285/ SUSE CVE CVE-2019-7285 page https://www.suse.com/security/cve/CVE-2019-7292/ SUSE CVE CVE-2019-7292 page https://www.suse.com/security/cve/CVE-2019-8503/ SUSE CVE CVE-2019-8503 page https://www.suse.com/security/cve/CVE-2019-8506/ SUSE CVE CVE-2019-8506 page https://www.suse.com/security/cve/CVE-2019-8515/ SUSE CVE CVE-2019-8515 page https://www.suse.com/security/cve/CVE-2019-8518/ SUSE CVE CVE-2019-8518 page https://www.suse.com/security/cve/CVE-2019-8523/ SUSE CVE CVE-2019-8523 page https://www.suse.com/security/cve/CVE-2019-8524/ SUSE CVE CVE-2019-8524 page https://www.suse.com/security/cve/CVE-2019-8535/ SUSE CVE CVE-2019-8535 page https://www.suse.com/security/cve/CVE-2019-8536/ SUSE CVE CVE-2019-8536 page https://www.suse.com/security/cve/CVE-2019-8544/ SUSE CVE CVE-2019-8544 page https://www.suse.com/security/cve/CVE-2019-8551/ SUSE CVE CVE-2019-8551 page https://www.suse.com/security/cve/CVE-2019-8558/ SUSE CVE CVE-2019-8558 page https://www.suse.com/security/cve/CVE-2019-8559/ SUSE CVE CVE-2019-8559 page https://www.suse.com/security/cve/CVE-2019-8563/ SUSE CVE CVE-2019-8563 page SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Desktop Applications 15 libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 libjavascriptcoregtk-4_0-18-32bit-2.24.1-3.24.1 libjavascriptcoregtk-4_0-18-64bit-2.24.1-3.24.1 libwebkit2gtk-4_0-37-2.24.1-3.24.1 libwebkit2gtk-4_0-37-32bit-2.24.1-3.24.1 libwebkit2gtk-4_0-37-64bit-2.24.1-3.24.1 libwebkit2gtk3-lang-2.24.1-3.24.1 typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 webkit-jsc-4-2.24.1-3.24.1 webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 webkit2gtk3-devel-2.24.1-3.24.1 webkit2gtk3-minibrowser-2.24.1-3.24.1 libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libwebkit2gtk-4_0-37-2.24.1-3.24.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libwebkit2gtk3-lang-2.24.1-3.24.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 webkit2gtk3-devel-2.24.1-3.24.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded. CVE-2019-11070 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-11070.html CVE-2019-11070 https://bugzilla.suse.com/1132196 SUSE Bug 1132196 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-6201 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-6201.html CVE-2019-6201 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge. CVE-2019-6251 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-6251.html CVE-2019-6251 https://bugzilla.suse.com/1121894 SUSE Bug 1121894 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-7285 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-7285.html CVE-2019-7285 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may result in the disclosure of process memory. CVE-2019-7292 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-7292.html CVE-2019-7292 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website. CVE-2019-8503 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8503.html CVE-2019-8503 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8506 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8506.html CVE-2019-8506 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may disclose sensitive user information. CVE-2019-8515 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8515.html CVE-2019-8515 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8518 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8518.html CVE-2019-8518 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8523 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8523.html CVE-2019-8523 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8524 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8524.html CVE-2019-8524 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8535 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8535.html CVE-2019-8535 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8536 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8536.html CVE-2019-8536 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8544 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8544.html CVE-2019-8544 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to universal cross site scripting. CVE-2019-8551 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8551.html CVE-2019-8551 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8558 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8558.html CVE-2019-8558 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8559 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8559.html CVE-2019-8559 https://bugzilla.suse.com/1132256 SUSE Bug 1132256 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2019-8563 SUSE Linux Enterprise Module for Basesystem 15:libjavascriptcoregtk-4_0-18-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk-4_0-37-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:libwebkit2gtk3-lang-2.24.1-3.24.1 SUSE Linux Enterprise Module for Basesystem 15:webkit2gtk-4_0-injected-bundles-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-JavaScriptCore-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-WebKit2WebExtension-4_0-2.24.1-3.24.1 SUSE Linux Enterprise Module for Desktop Applications 15:webkit2gtk3-devel-2.24.1-3.24.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191137-1/ https://www.suse.com/security/cve/CVE-2019-8563.html CVE-2019-8563 https://bugzilla.suse.com/1132256 SUSE Bug 1132256