CVE-2023-2203
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use...
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
- Record
CVE-2023-2203- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
- Record
CVE-2023-2203- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2023-33715
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
- Record
EUVD-2023-33715- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p2w5-xch3-v6pv
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use...
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
- Record
GHSA-p2w5-xch3-v6pv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRHSA-2023:2653
Red Hat Security Advisory: webkit2gtk3 security update
- Record
RHSA-2023:2653- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3108
Red Hat Security Advisory: webkit2gtk3 security update
- Record
RHSA-2023:3108- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2023-2203
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
- Record
UBUNTU-CVE-2023-2203- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2023:2653 No score
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- WebKitGTK: Regression of CVE-2023-28205 fixes in the AlmaLinux (CVE-2023-2203)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:2653- Updated
- 2026-11-02
OSVALSA-2023:3108 No score
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- WebKitGTK: Regression of CVE-2023-28205 fixes in the AlmaLinux (CVE-2023-2203)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:3108- Updated
- 2026-11-02
OSVRLSA-2023:3108 No score
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- WebKitGTK: Regression of CVE-2023-28205 fixes in the Rocky Linux (CVE-2023-2203)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2023:3108- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2gtk3AlmaLinux:9 From an advisory covering 2 CVEs |
before 2.38.5-1.el9_2.1 | 2.38.5-1.el9_2.1 |
webkit2gtk3-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 2.38.5-1.el9_2.1 | 2.38.5-1.el9_2.1 |
webkit2gtk3-jscAlmaLinux:9 From an advisory covering 2 CVEs |
before 2.38.5-1.el9_2.1 | 2.38.5-1.el9_2.1 |
webkit2gtk3-jsc-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 2.38.5-1.el9_2.1 | 2.38.5-1.el9_2.1 |
webkit2gtk3AlmaLinux:8 From an advisory covering 2 CVEs |
before 2.38.5-1.el8_8.3 | 2.38.5-1.el8_8.3 |
webkit2gtk3-develAlmaLinux:8 From an advisory covering 2 CVEs |
before 2.38.5-1.el8_8.3 | 2.38.5-1.el8_8.3 |
webkit2gtk3-jscAlmaLinux:8 From an advisory covering 2 CVEs |
before 2.38.5-1.el8_8.3 | 2.38.5-1.el8_8.3 |
webkit2gtk3-jsc-develAlmaLinux:8 From an advisory covering 2 CVEs |
before 2.38.5-1.el8_8.3 | 2.38.5-1.el8_8.3 |
webkit2gtk3Red Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
webkit2gtk3-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
webkit2gtk3-develRed Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
webkit2gtk3-jscRed Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.38.5-1.el9_2.1 | 0:2.38.5-1.el9_2.1 |
webkit2gtk3Red Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3-develRed Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3-jscRed Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtk3Rocky Linux:8 |
before 0:2.38.5-1.el8_8.3 | 0:2.38.5-1.el8_8.3 |
webkit2gtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1 |
None known |
webkit2gtkUbuntu:18.04:LTS |
All versions, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 33 moreShow less2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.12.22.5-0ubuntu0.18.04.12.22.6-0ubuntu0.18.04.12.24.1-0ubuntu0.18.04.12.24.2-0ubuntu0.18.04.12.24.4-0ubuntu0.18.04.12.26.1-0ubuntu0.18.04.12.26.2-0ubuntu0.18.04.12.26.3-0ubuntu0.18.04.12.26.4-0ubuntu0.18.04.12.28.0-0ubuntu0.18.04.32.28.1-0ubuntu0.18.04.12.28.2-0ubuntu0.18.04.12.28.3-0ubuntu0.18.04.12.28.4-0ubuntu0.18.04.12.30.3-0ubuntu0.18.04.12.30.5-0ubuntu0.18.04.12.30.6-0ubuntu0.18.04.12.32.0-0ubuntu0.18.04.12.32.3-0ubuntu0.18.04.12.32.4-0ubuntu0.18.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2203 is a high vulnerability (CVSS 8.8) in Redhat Enterprise Linux, published May 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in webkit2gtk3 0:2.38.5-1.el9_2.1.
References
bugzilla.redhat.com/show_bug.cgi?id=2188543
access.redhat.com/security/cve/CVE-2023-2203
nvd.nist.gov/vuln/detail/CVE-2023-2203
github.com/advisories/GHSA-p2w5-xch3-v6pv
Show 9 moreShow less
errata.almalinux.org/9/ALSA-2023-2653.html
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2653.json
cve.org/CVERecord?id=CVE-2023-2203
errata.rockylinux.org/RLSA-2023:3108
ubuntu.com/security/CVE-2023-2203