Description
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WebKitGTK | Affects webkit2gtk3 v2.38.5-1.el8 and webkit2gtk3 v2.38.5-1.el9, Fixed in webkit2gtk3 v2.38.5-1.el8_8.3 and webkit2gtk3 v2.38.5-1.el9_2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | webkit2gtk | No fix yet | — |
| Ubuntu 16.04 LTS | webkit2gtk | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | webkit2gtk3 +3 | 2.38.5-1.el9_2.1 | RHSA-2023:2653 |
| RHEL 8 | webkit2gtk3 +3 | 2.38.5-1.el8_8.3 | RHSA-2023:3108 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | webkit2gtk3 +3 | 2.38.5-1.el9_2.1 | ALSA-2023:2653 |
| AlmaLinux 8 | webkit2gtk3 +3 | 2.38.5-1.el8_8.3 | ALSA-2023:3108 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | webkit2gtk3 | 2.38.5-1.el8_8.3 | RLSA-2023:3108 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | webkitgtk4 +3 | 2.38.5-3.amzn2.0.1 | ALAS2-2023-2088 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | webkit2gtk3 +3 | 2.38.5-1.el9_2.1 | ELSA-2023-2653 |
| Oracle Linux 8 | webkit2gtk3 +3 | 2.38.5-1.el8_8.3 | ELSA-2023-3108 |
Advisories 9
- ALSA-2023:2653 Important: webkit2gtk3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:3108 Important: webkit2gtk3 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2023-1185 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 3, 2026
- RLSA-2023:3108 Important: webkit2gtk3 security update Rocky Linux Security Advisories · Feb 4, 2026
- RHSA-2023:3108 Red Hat Security Advisory: webkit2gtk3 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:2653 Red Hat Security Advisory: webkit2gtk3 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ALAS2-2023-2088 Important: webkitgtk4 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 28, 2024
- ELSA-2023-3108 Important: webkit2gtk3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2023
- ELSA-2023-2653 Important: webkit2gtk3 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 17, 2023