webkitgtk: Processing web content may lead to arbitrary code execution

A vulnerability was found in WebKitGTK and WPE WebKit, which allows remote attacker to perform arbitrary code execution when processing web content. This vulnerability caused by insufficient checks, which could be exploited by attackers to execute malicious code on affected systems...

The vulnerability of the web page rendering modules in WebKitGTK and WPE for Apple’s operating systems such as iOS, iPadOS, tvOS, watchOS, macOS Sonoma, as well as the Safari browser, allows attackers to execute arbitrary code.

The vulnerability of the web page rendering modules in WebKitGTK and WPE for Apple’s iOS, iPadOS, tvOS, watchOS, macOS Sonoma, and Safari browsers stems from operations that occur outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2023-8209 · Apple +9 · Macos Sonoma +15

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 17.2 macOS Sonoma versions prior to 14.2 iOS versions prior to 17.2 iPadOS versions prior to 17.2 watchOS versions prior to 10.2 tvOS versions prior to 17.2 iOS versions prior to 16.7.3 iPadOS versions prior to 16.7.3...

webkitgtk: Memory corruption issue when processing web content

A vulnerability was found in WebKitGTK. This security issue occurs when processing maliciously crafted web content that may lead to arbitrary code execution. This memory corruption issue was addressed with improved validation...

The vulnerability of the Web page rendering modules in WebKitGTK+ and WPE WebKit lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Web page rendering modules in WebKitGTK+ and WPE WebKit relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

The vulnerability of the web page rendering modules in WebKitGTK+ and WPE WebKit operating systems for iOS, iPadOS, tvOS, macOS, watchOS, and the Safari browser allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Web page rendering modules in WebKitGTK+ and WPE WebKit operating systems for iOS, iPadOS, tvOS, macOS, watchOS, and the Safari browser is related to the disclosure of information. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to...

The vulnerability of the web page rendering modules in WebKitGTK and WPE for iOS, iPadOS, macOS, watchOS, Safari browser allows a perpetrator to execute arbitrary code.

The vulnerability of the web page rendering modules in WebKitGTK and WPE for iOS, iPadOS, tvOS, macOS, watchOS, and the Safari browser is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to incorrect privilege assignment, allows attackers to access confidential data.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to the improper assignment of privileges. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

webkitgtk: issue was addressed with improved UI handling

A vulnerability was found in webkitgtk, where an issue was addressed with improved UI handling. Visiting a website that frames malicious content may lead to UI spoofing...

webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps()

A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely...

webkitgtk: memory corruption issue leading to arbitrary code execution

A vulnerability was found in WebKitGTK. This issue occurs when processing maliciously crafted web content in WebKit. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption, and execute arbitrary code on the target system...

UBUNTU-CVE-2023-25362

A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely...

USN-5893-1 webkit2gtk vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

SUSE CVE-2010-3812

Integer overflow in the Text::wholeText method in dom/Text.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products allows remote attackers to execute arbitrary code or cau...

SUSE CVE-2013-7324

Webkit-GTK 2.x any version with HTML5 audio/video support based on GStreamer allows remote attackers to trigger unexpectedly high sound volume via malicious javascript. NOTE: this WebKit-GTK behavior complies with existing W3C standards and existing practices for GNOME desktop integration...

SUSE CVE-2017-1000122

The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service release assertion of the UI process. This vulnerability does not affect Apple products...

SUSE CVE-2018-11713

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by...

SUSE CVE-2018-11712

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed to perform TLS certificate verification for WebSocket connections...

SUSE CVE-2018-12293

The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.3 and WPE WebKit prior to version 2.20.1, is vulnerable to a heap-based buffer overflow triggered by an integer overflow, which...

SUSE CVE-2019-6251

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...