PT-2022-3506 · Apple+7 · Webkitgtk+8

Chijin Zhou · Published 2022-04-22 · Updated 2022-11-15 · CVE-2022-30293

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebKitGTK versions through 2.36.0 WPE WebKit versions through 2.36.0

Description The issue is related to a heap-based buffer overflow in the WebCore::TextureMapperLayer::setContentsLayer function, located in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp, which is part of the WebKitGTK and WPE WebKit modules for rendering web pages. This can be exploited by a remote attacker to execute arbitrary code or cause a denial of service.

Recommendations For WebKitGTK versions through 2.36.0, update to a version later than 2.36.0 to resolve the issue. For WPE WebKit versions through 2.36.0, update to a version later than 2.36.0 to resolve the issue. As a temporary workaround, consider disabling the WebCore::TextureMapperLayer::setContentsLayer function until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2022:7704

ALSA-2022:8054

ALT-PU-2022-1740

ALT-PU-2022-2162

BDU:2022-04287

CESA-2022_7704

CVE-2022-30293

DSA-5154-1

DSA-5155-1

OESA-2022-1698

OPENSUSE-SU-2022_2071-1

OPENSUSE-SU-2022_2072-1

RHSA-2022:7704

RHSA-2022:8054

RHSA-2022_7704

RHSA-2022_8054

RHSA-2025:10364

RLSA-2022:7704

RLSA-2022:8054

SUSE-SU-2022:2030-1

SUSE-SU-2022:2071-1

SUSE-SU-2022:2072-1

SUSE-SU-2022:2089-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Red Hat

Rocky Linux

Suse

Wpe Webkit

Webkitgtk

References · 93

• 🔥 https://github.com/theori-io/CVE-2022-26717-Safari-WebGL-Exploit · Exploit
• 🔥 https://github.com/parsdefense/CVE-2022-22629 · Exploit
• 🔥 https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.36.0 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-30293 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-30293 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-8054.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04287 · Security Note
• https://debian.org/security/2022/dsa-5154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30293 · Security Note
• https://osv.dev/vulnerability/ALSA-2022:8054 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30293 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:8054 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2089-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30294 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory