Red Hat Security Advisory: webkit2gtk3 security, bug fix, and enhancement update

Fixed packages 9

Vulnerabilities 22

• High 8.8
  CVE-2022-32885

  A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macO…

  Apple macOS webkit2gtk webkit2gtk macOS Debian Ubuntu
  May 8, 2023
• High 8.8
  CVE-2023-38600 Public exploit

  The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jul 27, 2023
• High 8.8
  CVE-2023-42833

  A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and i…

  Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu
  Jan 10, 2024
• Medium 6.5
  CVE-2023-27954

  The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  May 8, 2023
• Medium 5.5
  CVE-2023-27932

  This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  May 8, 2023
• Medium 5.3
  CVE-2022-32933

  An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12…

  Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu
  Jun 10, 2024
• Medium 4.7
  CVE-2022-32919

  The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1.…

  Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu
  Jan 10, 2024
• Unscored —
  CVE-2022-46705

  A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue i…

  Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu
  Feb 27, 2023
• Unscored —
  CVE-2022-46725

  A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue i…

  Apple iOS and iPadOS qtwebkit-source qtwebkit-opensource-src iOS Debian Ubuntu
  Aug 14, 2023
• Unscored —
  CVE-2023-28198

  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4, …

  Apple macOS iOS and iPadOS qtwebkit-source macOS iOS Debian Ubuntu
  Aug 14, 2023
• Unscored —
  CVE-2023-32370

  A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Polic…

  Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu
  Sep 6, 2023
• Unscored —
  CVE-2023-32393

  The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu
  Jul 27, 2023
• Unscored —
  CVE-2023-38133

  The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS …

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jul 26, 2023
• Unscored —
  CVE-2023-38572

  The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS …

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jul 27, 2023
• Unscored —
  CVE-2023-38592

  A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.6 and iPadOS 16.6, watchOS 9.6, t…

  Apple macOS iOS and iPadOS watchOS macOS iOS Debian Ubuntu
  Jul 28, 2023
• Unscored —
  CVE-2023-38594

  The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS …

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jul 26, 2023
• Unscored —
  CVE-2023-38595

  The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jul 27, 2023
• Unscored —
  CVE-2023-38597

  The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS …

  Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu
  Jul 26, 2023
• Unscored —
  CVE-2023-38599

  A logic issue was addressed with improved state management. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jul 28, 2023
• Unscored —
  CVE-2023-38611

  The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macO…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jul 27, 2023
• Unscored —
  CVE-2023-40397

  The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able …

  Apple macOS qtwebkit-source qtwebkit-opensource-src macOS Debian Ubuntu
  Sep 6, 2023
• Unscored —
  CVE-2023-40451

  This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with J…

  Apple Safari qtwebkit-source qtwebkit-opensource-src Browsers Debian Ubuntu
  Sep 26, 2023

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.9_release_notes/index
• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2176269
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224608
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231015
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231018
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231020
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231021
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231022
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231028
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231043
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236843
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236844
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2238943
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2238944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2238945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241409
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270146
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2271437
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2271441
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2271444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2271446
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7055.json
• report
  https://access.redhat.com/security/cve/CVE-2022-32885
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32885
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32885
• article
  https://webkitgtk.org/security/WSA-2023-0003.html
• report
  https://access.redhat.com/security/cve/CVE-2022-32919
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32919
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32919
• article
  https://webkitgtk.org/security/WSA-2023-0010.html
• report
  https://access.redhat.com/security/cve/CVE-2022-32933
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32933
• report
  https://access.redhat.com/security/cve/CVE-2022-46705
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-46705