PT-2022-7558 · Webkitgtk+6 · Webkitgtk+6

Published 2022-05-16 · Updated 2022-11-03 · CVE-2022-22677

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WPE WebKit versions prior to 2.36.4 WebKitGTK versions prior to 2.36.4

Description The issue is related to errors in resource release, allowing a remote attacker to impact data integrity. It involves a logic problem in handling concurrent media, which has been addressed with improved state handling. This may cause interruptions in video self-preview during a webRTC call if the user answers a phone call.

Recommendations For WPE WebKit versions prior to 2.36.4, update to version 2.36.4 or later. For WebKitGTK versions prior to 2.36.4, update to version 2.36.4 or later. As a temporary workaround, consider disabling the handling of concurrent media in webRTC calls until a patch is available.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2024-07314

CVE-2022-22677

DSA-5182-1

DSA-5183-1

MGASA-2022-0254

OPENSUSE-SU-2022_2523-1

OPENSUSE-SU-2022_2525-1

RHSA-2025:10364

SUSE-SU-2022:2522-1

SUSE-SU-2022:2523-1

SUSE-SU-2022:2524-1

SUSE-SU-2022:2525-1

USN-5522-1

Affected Products

Astra Linux

Linuxmint

Apple Macos

Suse

Ubuntu

Wpe Webkit

Webkitgtk

References · 36

• https://security-tracker.debian.org/tracker/CVE-2022-22677 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5522-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5183-1 · Vendor Advisory
• https://support.apple.com/en-us/HT213258 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5182-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0254.html · Security Note
• https://support.apple.com/en-us/HT213257 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2522-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22677 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:2523-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0254 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22677 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-22677 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:2525-1 · Vendor Advisory