Lucene search

K
debianDebianDEBIAN:DSA-5352-1:3471F
HistoryFeb 16, 2023 - 11:22 p.m.

[SECURITY] [DSA 5352-1] wpewebkit security update

2023-02-1623:22:47
lists.debian.org
30
wpe webkit
security update
cve-2023-23529
arbitrary code execution
debian

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

64.7%


Debian Security Advisory DSA-5352-1 [email protected]
https://www.debian.org/security/ Alberto Garcia
February 17, 2023 https://www.debian.org/security/faq


Package : wpewebkit
CVE ID : CVE-2023-23529

The following vulnerabilities have been discovered in the WPE WebKit
web engine:

CVE-2023-23529

An anonymous researcher discovered that processing maliciously
crafted web content may lead to arbitrary code execution. Apple is
aware of a report that this issue may have been actively
exploited.

For the stable distribution (bullseye), this problem has been fixed in
version 2.38.5-1~deb11u1.

We recommend that you upgrade your wpewebkit packages.

For the detailed security status of wpewebkit please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/wpewebkit

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

64.7%