PT-2022-7520 · Webkitgtk+7 · Webkitgtk+7

Chijin · Published 2022-07-13 · Updated 2024-09-18 · CVE-2023-25363

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebKitGTK versions prior to 2.36.8

Description A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags allows attackers to execute code remotely. This issue is related to the rendering of web pages and can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For WebKitGTK versions prior to 2.36.8, update to version 2.36.8 or later to resolve the issue. As a temporary workaround, consider disabling the updateDescendantDependentFlags function in WebCore::RenderLayer until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2023:2256

ALSA-2023:2834

ALT-PU-2022-2670

ALT-PU-2022-2671

ALT-PU-2022-2672

BDU:2024-06942

CESA-2023_2834

CVE-2023-25363

DLA-3124-1

DSA-5240-1

DSA-5241-1

RHSA-2023:2256

RHSA-2023:2834

RHSA-2023_2256

RHSA-2023_2834

SUSE-SU-2023:2056-1

SUSE-SU-2023:2065-1

SUSE-SU-2023:2077-1

SUSE-SU-2023:2078-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Red Hat

Red Os

Suse

Webkitgtk

References · 96

• https://osv.dev/vulnerability/SUSE-SU-2023:2065-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2078-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-32 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-25363 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2056-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06942 · Security Note
• https://osv.dev/vulnerability/DSA-5241-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:2834 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-25363 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-2256.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-25363 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-25363 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5240-1 · Vendor Advisory