CVE-2023-2203

2023-05-1722:15:10

CWE-416

[email protected]

web.nvd.nist.gov

cve-2023-2203

webkitgtk

input validation

use-after-free

denial of service

arbitrary code execution

nvd

red hat enterprise linux

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.3%

JSON

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Affected configurations

Vulners

NVD

Node

webkitgtkwebkitgtkRange≤2.38.5

webkitgtkwebkitgtkRange2.38.5–8.3

webkitgtkwebkitgtk

VendorProductVersionCPE
webkitgtkwebkitgtk*cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
webkitgtkwebkitgtk*cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
webkitgtkwebkitgtk*cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
webkitgtkwebkitgtk*cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
webkitgtk	webkitgtk	*	cpe:2.3:a:webkitgtk:webkitgtk::::::::
webkitgtk	webkitgtk	*	cpe:2.3:a:webkitgtk:webkitgtk::::::::
webkitgtk	webkitgtk	*	cpe:2.3:a:webkitgtk:webkitgtk::::::::
webkitgtk	webkitgtk	*	cpe:2.3:a:webkitgtk:webkitgtk::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "WebKitGTK",
    "versions": [
      {
        "version": "Affects webkit2gtk3 v2.38.5-1.el8 and webkit2gtk3 v2.38.5-1.el9, Fixed in webkit2gtk3 v2.38.5-1.el8_8.3 and webkit2gtk3 v2.38.5-1.el9_2.1",
        "status": "affected"
      }
    ]
  }
]