CVE-2023-2203

2023-05-1700:00:00

ubuntu.com

flaw

webkitgtk

use-after-free

vulnerability

denial of service

arbitrary code execution

cve-2023-2203

security regression

red hat enterprise linux

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

71.3%

JSON

A flaw was found in the WebKitGTK package. An improper input validation
issue may lead to a use-after-free vulnerability. This flaw allows
attackers with network access to pass specially crafted web content files,
causing a denial of service or arbitrary code execution. This CVE exists
because of a CVE-2023-28205 security regression for the WebKitGTK package
in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=2188543>

Notes

Author	Note
jdstrand	webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8
mdeslaur	This CVE is specific to Red Hat’s webkitgtk package, Ubuntu is not vulnerable to this issue.