Red Hat Security Advisory

RHSA-2023:6535

webkit2gtk3 security, bug fix, and enhancement update

Released 2023-11-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3-2.40.5-1.el9, webkit2gtk3-devel-2.40.5-1.el9, webkit2gtk3-jsc-2.40.5-1.el9 +1

Fixes 22 records

TI-2023-21216 CVE-2023-40397 · GHSA-6x6m-3789-2cmw

Apple macOS: A remote attacker may be able to cause arbitrary javascript code execution

MEDIUM 45

The issue was addressed with improved checks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01674 Published 2023-09-06 Partial fix · 13.5

TI-2023-19972 CVE-2023-38600 · GHSA-p785-479c-32q6

Apple Safari: Processing web content may lead to arbitrary code execution

MEDIUM 43

The issue was addressed with improved checks.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0143 Published 2023-07-27 Partial fix · 16.6, 13.5 +1

TI-2023-22922 CVE-2023-42833 · GHSA-q6j4-xjv3-96rj

Code injection in Apple iOS and iPadOS

MEDIUM 42

A correctness issue was addressed with improved checks.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00993 Published 2024-01-10 Partial fix · 17, 14 CWE-94

TI-2023-21269 CVE-2023-40451 · GHSA-p489-ffhp-rw3f

Apple Safari: An attacker with JavaScript execution may be able to execute arbitrary code

MEDIUM 42

This issue was addressed with improved iframe sandbox enforcement.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01085 Published 2023-09-26 Partial fix · 17

TI-2023-19983 CVE-2023-38611 · GHSA-pxp9-4fx7-v479

Apple Safari: Processing web content may lead to arbitrary code execution

MEDIUM 41

The issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01264 Published 2023-07-27 Partial fix · 16.6, 13.5 +1

TI-2023-19967 CVE-2023-38595 · GHSA-xf6p-jxqp-mvh4

Apple Safari: Processing web content may lead to arbitrary code execution

MEDIUM 41

The issue was addressed with improved checks.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01264 Published 2023-07-27 Partial fix · 16.6, 13.5 +1

TI-2023-19966 CVE-2023-38594 · GHSA-rv3f-cww5-rv8r

Apple Safari: Processing web content may lead to arbitrary code execution

MEDIUM 41

The issue was addressed with improved checks.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01243 Published 2023-07-26 Partial fix · 16.6, 13.5 +2

TI-2022-14412 CVE-2022-32885

Out-of-bounds write in Apple macOS

MEDIUM 41

A memory corruption issue was addressed with improved validation.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00799 Published 2023-05-08 Partial fix · 12.5, 15.6 CWE-787

TI-2023-19969 CVE-2023-38597 · GHSA-xqh8-5mp7-f6qr

Apple Safari: Processing web content may lead to arbitrary code execution

MEDIUM 40

The issue was addressed with improved checks.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01211 Published 2023-07-26 Partial fix · 16.6, 13.5 +1

TI-2023-19964 CVE-2023-38592 · GHSA-959x-mqwc-q2fp

Apple tvOS: Processing web content may lead to arbitrary code execution

MEDIUM 40

A logic issue was addressed with improved restrictions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01211 Published 2023-07-28 Partial fix · 16.6, 13.5 +1

TI-2023-15683 CVE-2023-32393 · GHSA-9hxv-f7q5-4j7c

Apple iOS and iPadOS: Processing web content may lead to arbitrary code execution

MEDIUM 40

The issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00952 Published 2023-07-27 Partial fix · 16.3, 13.2 +1

TI-2023-12762 CVE-2023-28198 · GHSA-p6rj-wprj-c52h

Use after free in Apple macOS

MEDIUM 40

A use-after-free issue was addressed with improved memory management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00926 Published 2023-08-14 Partial fix · 13.3, 16.4 CWE-416

TI-2023-19947 CVE-2023-38572 · GHSA-qfg5-2446-wqxx

Apple Safari: A website may be able to bypass Same Origin Policy

LOW 35

The issue was addressed with improved checks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01168 Published 2023-07-27 Partial fix · 16.6, 13.5 +2

TI-2023-19971 CVE-2023-38599 · GHSA-c9g8-3cc3-422m

Apple Safari: A website may be able to track sensitive user information

LOW 31

A logic issue was addressed with improved state management.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01043 Published 2023-07-28 Partial fix · 16.6, 13.5 +2

TI-2023-19556 CVE-2023-38133 · GHSA-57gp-c4c9-4j3c

Apple Safari: Processing web content may disclose sensitive information

LOW 31

The issue was addressed with improved checks.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01043 Published 2023-07-26 Partial fix · 16.6, 13.5 +2

TI-2023-15661 CVE-2023-32370 · GHSA-m6rg-hrc7-fqpj

Apple macOS: Content Security Policy to block domains with wildcards may fail

LOW 31

A logic issue was addressed with improved validation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00787 Published 2023-09-06 Partial fix · 13.3

TI-2023-12544 CVE-2023-27954 · GHSA-2q9c-qj72-94fh

Incorrect authorization in Apple macOS

LOW 31

The issue was addressed by removing origin information.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00926 Published 2023-05-08 Partial fix · 13.3, 16.4 +2 CWE-863

TI-2022-14457 CVE-2022-32933 · GHSA-h9rg-mrq2-9rc6

Information disclosure in Apple macOS

LOW 25

An information disclosure issue was addressed by removing the vulnerable code.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00487 Published 2024-06-10 Partial fix · 12.5 CWE-200

TI-2023-12522 CVE-2023-27932 · GHSA-j4q3-cq76-4p2r

Origin validation error in Apple macOS

LOW 24

This issue was addressed with improved state management.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00202 Published 2023-05-08 Partial fix · 13.3, 16.4 +1 CWE-346

TI-2022-23095 CVE-2022-46705 · GHSA-wx4m-4gqh-j3gc

A spoofing issue existed in the handling of URLs.

LOW 22

A spoofing issue existed in the handling of URLs.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00973 Published 2023-02-27 Partial fix · 13.1, 16.2

TI-2022-14445 CVE-2022-32919 · GHSA-4m5w-jr92-m987

Clickjacking in Apple macOS

LOW 22

The issue was addressed with improved UI handling.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00588 Published 2024-01-10 Partial fix · 13.1, 16.2 CWE-1021

TI-2022-23110 CVE-2022-46725 · GHSA-43qx-6r5f-7vgw

A spoofing issue existed in the handling of URLs.

LOW 21

A spoofing issue existed in the handling of URLs.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.006 Published 2023-08-14 Partial fix · 16.4