Red Hat Security Advisory: webkit2gtk3 security and bug fix update

Fixed packages 9

Vulnerabilities 23

• High 8.8
  CVE-2022-48503 Exploited

  The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Aug 14, 2023

  KEV Oct 20, 2025
• High 8.8
  CVE-2022-32886

  A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7…

  Apple iOS and iPadOS Safari iOS iOS Browsers Debian Ubuntu
  Sep 20, 2022
• High 8.8
  CVE-2022-32888

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.7, ma…

  Apple macOS watchOS qtwebkit-source macOS Debian Ubuntu
  Nov 1, 2022
• High 8.8
  CVE-2022-42823

  A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13,…

  Apple macOS watchOS tvOS macOS Debian Ubuntu
  Nov 1, 2022
• High 8.8
  CVE-2022-42863

  A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, …

  Apple watchOS tvOS qtwebkit-source Debian Ubuntu
  Dec 15, 2022
• High 8.8
  CVE-2022-42867 EPSS 35%

  A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, ma…

  Apple watchOS tvOS qtwebkit-source Debian Ubuntu
  Dec 15, 2022
• High 8.8
  CVE-2022-46691

  A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, …

  Apple watchOS tvOS qtwebkit-source Debian Ubuntu
  Dec 15, 2022
• High 8.8
  CVE-2022-46699

  A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, …

  Apple watchOS tvOS qtwebkit-source Debian Ubuntu
  Dec 15, 2022
• High 8.8
  CVE-2022-46700

  A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, …

  Apple watchOS tvOS qtwebkit-source Debian Ubuntu
  Dec 15, 2022
• High 8.8
  CVE-2023-23517

  The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Feb 27, 2023
• High 8.8
  CVE-2023-23518

  The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Feb 27, 2023
• High 8.8
  CVE-2023-25358

  A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute…

  qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu
  Mar 2, 2023
• High 8.8
  CVE-2023-25360

  A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute…

  webkit2gtk webkitgtk wpewebkit Debian Ubuntu
  Mar 2, 2023
• High 8.8
  CVE-2023-25361

  A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to e…

  webkit2gtk webkitgtk wpewebkit Debian Ubuntu
  Mar 2, 2023
• Medium 6.5
  CVE-2022-32923

  A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPa…

  Apple macOS watchOS tvOS macOS Debian Ubuntu
  Nov 1, 2022
• Medium 6.5
  CVE-2022-42852

  The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.…

  Apple watchOS tvOS qtwebkit-source Debian Ubuntu
  Dec 15, 2022
• Medium 6.5
  CVE-2022-46698

  A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.…

  Apple watchOS tvOS iCloud for Windows Windows Debian Ubuntu
  Dec 15, 2022
• Medium 6.1
  CVE-2022-42799

  The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Saf…

  Apple macOS watchOS tvOS macOS Debian Ubuntu
  Nov 1, 2022
• Medium 5.5
  CVE-2022-42824

  A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS…

  Apple macOS watchOS tvOS macOS Debian Ubuntu
  Nov 1, 2022
• Medium 5.5
  CVE-2022-46692

  A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for W…

  Apple watchOS tvOS iCloud for Windows Windows Debian Ubuntu
  Dec 15, 2022
• Unscored —
  CVE-2022-42826

  A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1…

  Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu
  Feb 27, 2023
• Unscored —
  CVE-2023-25362

  A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows att…

  webkit2gtk webkitgtk wpewebkit Debian Ubuntu
  Mar 2, 2023
• Unscored —
  CVE-2023-25363

  A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allow…

  webkit2gtk webkitgtk wpewebkit Debian Ubuntu
  Mar 2, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2127467
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128643
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140501
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140502
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140504
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140505
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156986
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156987
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156990
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156991
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156993
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156994
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2167715
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2167716
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2167717
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2175099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2175101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2175103
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2175105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2175107
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2256.json
• report
  https://access.redhat.com/security/cve/CVE-2022-32886
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32886
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32886
• article
  https://webkitgtk.org/security/WSA-2022-0009.html
• report
  https://access.redhat.com/security/cve/CVE-2022-32888
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32888
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32888
• article
  https://webkitgtk.org/security/WSA-2022-0010.html
• report
  https://access.redhat.com/security/cve/CVE-2022-32923
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32923
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32923
• report
  https://access.redhat.com/security/cve/CVE-2022-42799
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42799