Red Hat Security Advisory

RHSA-2023:2256

webkit2gtk3 security and bug fix update

Released 2023-05-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3-2.38.5-1.el9, webkit2gtk3-devel-2.38.5-1.el9, webkit2gtk3-jsc-2.38.5-1.el9 +1

Fixes 23 records

TI-2022-24081 CVE-2022-48503 · GHSA-hqf2-wqhm-8v23

Improper array index validation in Apple macOS

CRITICAL 97KEV

The issue was addressed with improved bounds checks.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03213 Published 2023-08-14 Partial fix · 12.5, 15.6 +1 CWE-129

TI-2022-20876 CVE-2022-42867 · GHSA-jhmj-whj3-74pr

Use after free in Apple tvOS

HIGH 66

A use after free issue was addressed with improved memory management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.34815 Published 2022-12-15 Partial fix · 16.2, 13.1 +1 CWE-416

TI-2022-20835 CVE-2022-42823 · GHSA-rjj4-r4wr-cjq8

Type confusion in Apple macOS

MEDIUM 44

A type confusion issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0183 Published 2022-11-01 Partial fix · 13, 16.1 +1 CWE-843

TI-2022-14413 CVE-2022-32886 · GHSA-rm7v-mc66-6r49

Out-of-bounds write in Apple iOS

MEDIUM 44

A buffer overflow issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01867 Published 2022-09-20 Partial fix · 16, 15.7 CWE-787

TI-2022-23090 CVE-2022-46700 · GHSA-9qwf-rgvm-3vxv

Out-of-bounds write in Apple tvOS

MEDIUM 43

A memory corruption issue was addressed with improved input validation.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01319 Published 2022-12-15 Partial fix · 16.2, 13.1 +2 CWE-787

TI-2022-23089 CVE-2022-46699 · GHSA-vpx9-p4q4-3hhh

Out-of-bounds write in Apple tvOS

MEDIUM 43

A memory corruption issue was addressed with improved state management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01303 Published 2022-12-15 Partial fix · 16.2, 13.1 +1 CWE-787

TI-2022-23081 CVE-2022-46691 · GHSA-p4fx-x9cg-v98g

Out-of-bounds write in Apple tvOS

MEDIUM 43

A memory consumption issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01623 Published 2022-12-15 Partial fix · 16.2, 13.1 +2 CWE-787

TI-2022-20872 CVE-2022-42863 · GHSA-34j8-gp4f-rgwg

Out-of-bounds write in Apple tvOS

MEDIUM 43

A memory corruption issue was addressed with improved state management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01236 Published 2022-12-15 Partial fix · 16.2, 13.1 +1 CWE-787

TI-2022-14415 CVE-2022-32888 · GHSA-c3gw-7267-x4wq

Out-of-bounds write in Apple macOS

MEDIUM 43

An out-of-bounds write issue was addressed with improved bounds checking.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01535 Published 2022-11-01 Partial fix · 13, 16 +4 CWE-787

TI-2023-10722 CVE-2023-25363 · GHSA-m6fv-rjwf-hmj9

A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in…

MEDIUM 42

A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00974 Published 2023-03-02 Partial fix CWE-416

TI-2023-10721 CVE-2023-25362 · GHSA-wjwh-3f92-h6f4

A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in…

MEDIUM 42

A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00974 Published 2023-03-02 Partial fix CWE-416

TI-2023-10720 CVE-2023-25361 · GHSA-w5w3-546h-h8fc

A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK…

MEDIUM 42

A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00974 Published 2023-03-02 Partial fix CWE-416

TI-2023-10719 CVE-2023-25360 · GHSA-hqcm-rrgq-jv8q

A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before…

MEDIUM 42

A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00974 Published 2023-03-02 Partial fix CWE-416

TI-2023-10718 CVE-2023-25358 · GHSA-xcc8-3vrq-wjg2

A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before…

MEDIUM 42

A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01062 Published 2023-03-02 Partial fix CWE-416

TI-2023-09351 CVE-2023-23518 · GHSA-9cf9-qjr8-c7jw

Out-of-bounds write in Apple iOS and iPadOS

MEDIUM 42

The issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00902 Published 2023-02-27 Partial fix · 16.3, 11.7 +3 CWE-787

TI-2023-09350 CVE-2023-23517 · GHSA-vjc5-4hxh-h2rw

Memory corruption in Apple iOS and iPadOS

MEDIUM 42

The issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00902 Published 2023-02-27 Partial fix · 16.3, 11.7 +3 CWE-119

TI-2022-20838 CVE-2022-42826 · GHSA-8hhw-p6vr-v3wv

Use after free in Apple macOS

MEDIUM 41

A use after free issue was addressed with improved memory management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00769 Published 2023-02-27 Partial fix · 13, 16.1 CWE-416

TI-2022-23088 CVE-2022-46698 · GHSA-3mmq-4r29-8xqf

Protection mechanism failure in Apple iCloud for Windows

LOW 31

A logic issue was addressed with improved checks.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01004 Published 2022-12-15 Partial fix · 14.1, 16.2 +2 CWE-693

TI-2022-20862 CVE-2022-42852 · GHSA-3p9p-h6x6-85gg

Information disclosure in Apple tvOS

LOW 31

The issue was addressed with improved memory handling.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01042 Published 2022-12-15 Partial fix · 16.2, 13.1 +2 CWE-200

TI-2022-20815 CVE-2022-42799 · GHSA-mjhv-4xgh-4wx2

Clickjacking in Apple macOS

LOW 31

The issue was addressed with improved UI handling.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01671 Published 2022-11-01 Partial fix · 13, 16.1 +1 CWE-1021

TI-2022-14448 CVE-2022-32923 · GHSA-4w5x-gxff-8vr4

Cross-site scripting in Apple macOS

LOW 31

A correctness issue in the JIT was addressed with improved checks.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01163 Published 2022-11-01 Partial fix · 13, 16.1 +2 CWE-79

TI-2022-20836 CVE-2022-42824 · GHSA-cjwx-h5pw-chvg

Apple macOS: Processing maliciously crafted web content may disclose sensitive user…

LOW 25

A logic issue was addressed with improved state management.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00359 Published 2022-11-01 Partial fix · 13, 16.1 +1

TI-2022-23082 CVE-2022-46692 · GHSA-gg8p-2j6g-g8mc

Insufficient verification of data authenticity in Apple iCloud for Windows

LOW 24

A logic issue was addressed with improved state management.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00208 Published 2022-12-15 Partial fix · 14.1, 16.2 +3 CWE-345