Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
almalinuxAlmaLinuxALSA-2023:2834
HistoryMay 16, 2023 - 12:00 a.m.

Important: webkit2gtk3 security and bug fix update

2023-05-1600:00:00
errata.almalinux.org
11

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

85.4%

JSON

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42826)
  • webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23517)
  • webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23518)
  • webkitgtk: buffer overflow issue was addressed with improved memory handling (CVE-2022-32886)
  • webkitgtk: out-of-bounds write issue was addressed with improved bounds checking (CVE-2022-32888)
  • webkitgtk: correctness issue in the JIT was addressed with improved checks (CVE-2022-32923)
  • webkitgtk: issue was addressed with improved UI handling (CVE-2022-42799)
  • webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2022-42823)
  • webkitgtk: sensitive information disclosure issue (CVE-2022-42824)
  • webkitgtk: memory disclosure issue was addressed with improved memory handling (CVE-2022-42852)
  • webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-42863)
  • webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42867)
  • webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46691)
  • webkitgtk: Same Origin Policy bypass issue (CVE-2022-46692)
  • webkitgtk: logic issue leading to user information disclosure (CVE-2022-46698)
  • webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46699)
  • webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46700)
  • webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild() (CVE-2023-25358)
  • webkitgtk: heap-use-after-free in WebCore::RenderLayer::renderer() (CVE-2023-25360)
  • webkitgtk: heap-use-after-free in WebCore::RenderLayer::setNextSibling() (CVE-2023-25361)
  • webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps() (CVE-2023-25362)
  • webkitgtk: heap-use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags() (CVE-2023-25363)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8i686webkit2gtk3-jsc-devel< 2.38.5-1.el8webkit2gtk3-jsc-devel-2.38.5-1.el8.i686.rpm
almalinux8i686webkit2gtk3-devel< 2.38.5-1.el8webkit2gtk3-devel-2.38.5-1.el8.i686.rpm
almalinux8i686webkit2gtk3< 2.38.5-1.el8webkit2gtk3-2.38.5-1.el8.i686.rpm
almalinux8i686webkit2gtk3-jsc< 2.38.5-1.el8webkit2gtk3-jsc-2.38.5-1.el8.i686.rpm
almalinux8aarch64webkit2gtk3-devel< 2.38.5-1.el8webkit2gtk3-devel-2.38.5-1.el8.aarch64.rpm
almalinux8aarch64webkit2gtk3-jsc< 2.38.5-1.el8webkit2gtk3-jsc-2.38.5-1.el8.aarch64.rpm
almalinux8aarch64webkit2gtk3-jsc-devel< 2.38.5-1.el8webkit2gtk3-jsc-devel-2.38.5-1.el8.aarch64.rpm
almalinux8aarch64webkit2gtk3< 2.38.5-1.el8webkit2gtk3-2.38.5-1.el8.aarch64.rpm
almalinux8x86_64webkit2gtk3< 2.38.5-1.el8webkit2gtk3-2.38.5-1.el8.x86_64.rpm
almalinux8x86_64webkit2gtk3-jsc-devel< 2.38.5-1.el8webkit2gtk3-jsc-devel-2.38.5-1.el8.x86_64.rpm
Rows per page:
1-10 of 201

References

Related

nessus 47
oraclelinux 2
osv 18
almalinux 1
redhat 2
gentoo 1
mageia 3
ubuntu 4
debian 12
apple 6
fedora 7
kaspersky 1
prion 21
ubuntucve 17
debiancve 20
redhatcve 19
cve 16
zdt 1
amazon 1
nessus
nessus
AlmaLinux 9 : webkit2gtk3 (ALSA-2023:2256)
2023-05-14 00:00:00
Oracle Linux 8 : webkit2gtk3 (ELSA-2023-2834)
2023-05-24 00:00:00
Oracle Linux 9 : webkit2gtk3 (ELSA-2023-2256)
2023-05-15 00:00:00
oraclelinux
oraclelinux
webkit2gtk3 security and bug fix update
2023-05-15 00:00:00
webkit2gtk3 security and bug fix update
2023-05-24 00:00:00
osv
osv
Important: webkit2gtk3 security and bug fix update
2023-05-16 00:00:00
Important: webkit2gtk3 security and bug fix update
2023-05-09 00:00:00
webkit2gtk - security update
2022-09-29 00:00:00
almalinux
almalinux
Important: webkit2gtk3 security and bug fix update
2023-05-09 00:00:00
redhat
redhat
(RHSA-2023:2834) Important: webkit2gtk3 security and bug fix update
2023-05-16 05:55:57
(RHSA-2023:2256) Important: webkit2gtk3 security and bug fix update
2023-05-09 05:05:11
gentoo
gentoo
WebKitGTK+: Multiple Vulnerabilities
2023-05-30 00:00:00
mageia
mageia
Updated webkit2 packages fix security vulnerability
2022-12-31 01:39:00
Updated webkit2 packages fix security vulnerability
2022-11-13 05:25:20
Updated webkit2 packages fix security vulnerability
2023-02-15 01:43:23
ubuntu
ubuntu
WebKitGTK vulnerabilities
2022-11-17 00:00:00
WebKitGTK vulnerabilities
2023-01-09 00:00:00
WebKitGTK vulnerabilities
2023-02-13 00:00:00
debian
debian
[SECURITY] [DSA 5309-1] wpewebkit security update
2022-12-31 00:43:12
[SECURITY] [DSA 5308-1] webkit2gtk security update
2022-12-31 00:42:12
[SECURITY] [DLA 3274-1] webkit2gtk security update
2023-01-19 10:10:28
apple
apple
About the security content of Safari 16.2
2022-12-13 00:00:00
About the security content of Safari 16.1
2022-10-24 00:00:00
About the security content of iCloud for Windows 14.1
2022-12-13 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: webkit2gtk3-2.38.3-1.fc36
2022-12-31 01:17:03
[SECURITY] Fedora 37 Update: webkitgtk-2.38.3-2.fc37
2022-12-27 01:13:43
[SECURITY] Fedora 37 Update: webkitgtk-2.38.2-1.fc37
2022-11-09 00:09:45
kaspersky
kaspersky
KLA20116 Multiple vulnerabilities in Apple iCloud
2022-12-13 00:00:00
prion
prion
Design/Logic Flaw
2023-03-02 16:15:00
Design/Logic Flaw
2023-03-02 15:15:00
Design/Logic Flaw
2022-11-01 20:15:00
ubuntucve
ubuntucve
CVE-2023-25362
2023-03-02 00:00:00
CVE-2023-25361
2023-03-02 00:00:00
CVE-2022-46691
2022-12-15 00:00:00
debiancve
debiancve
CVE-2022-46691
2022-12-15 19:15:00
CVE-2023-25363
2023-03-02 16:15:14
CVE-2022-32888
2022-11-01 20:15:00
redhatcve
redhatcve
CVE-2022-46691
2022-12-30 05:35:32
CVE-2022-32886
2022-09-21 10:18:53
CVE-2022-42867
2022-12-30 05:35:22
cve
cve
CVE-2022-32888
2022-11-01 20:15:00
CVE-2023-25362
2023-03-02 16:15:14
CVE-2023-25358
2023-03-02 15:15:10
zdt
zdt
WebKit CSSCrossfadeValue::crossfadeChanged Use-After-Free Vulnerability
2023-01-16 00:00:00
amazon
amazon
Important: webkitgtk4
2023-02-17 00:12:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

85.4%

JSON
Related for ALSA-2023:2834
nessus47oraclelinux2osv18almalinux1redhat2gentoo1mageia3ubuntu4debian12apple6fedora7kaspersky1prion21ubuntucve17debiancve20redhatcve19cve16zdt1amazon1