CVE-2023-25358
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8...
8.8 HighFix available
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.06%Down 1.5 points since Mar 3, 2023
What each source reports
NVD Score used
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- Record
CVE-2023-25358- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- Record
CVE-2023-25358- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2023-29316
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- Record
EUVD-2023-29316- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xcc8-3vrq-wjg2
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8...
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- Record
GHSA-xcc8-3vrq-wjg2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- Record
CVE-2023-25358- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-25358
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- Record
DEBIAN-CVE-2023-25358- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVRHSA-2023:2256
Red Hat Security Advisory: webkit2gtk3 security and bug fix update
- Record
RHSA-2023:2256- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:2834
Red Hat Security Advisory: webkit2gtk3 security and bug fix update
- Record
RHSA-2023:2834- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:10364
Red Hat Security Advisory: webkitgtk4 security update
- Record
RHSA-2025:10364- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-25358
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- Record
UBUNTU-CVE-2023-25358- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2023:2256 No score
Important: webkit2gtk3 security and bug fix update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42826)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23517)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23518)
- webkitgtk: buffer overflow issue was addressed with improved memory handling (CVE-2022-32886)
- webkitgtk: out-of-bounds write issue was addressed with improved bounds checking (CVE-2022-32888)
- webkitgtk: correctness issue in the JIT was addressed with improved checks (CVE-2022-32923)
- webkitgtk: issue was addressed with improved UI handling (CVE-2022-42799)
- webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2022-42823)
- webkitgtk: sensitive information disclosure issue (CVE-2022-42824)
- webkitgtk: memory disclosure issue was addressed with improved memory handling (CVE-2022-42852)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-42863)
- webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42867)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46691)
- webkitgtk: Same Origin Policy bypass issue (CVE-2022-46692)
- webkitgtk: logic issue leading to user information disclosure (CVE-2022-46698)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46699)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46700)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild() (CVE-2023-25358)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::renderer() (CVE-2023-25360)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::setNextSibling() (CVE-2023-25361)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps() (CVE-2023-25362)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags() (CVE-2023-25363)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2023:2256- Updated
- 2026-11-02
OSVALSA-2023:2834 No score
Important: webkit2gtk3 security and bug fix update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42826)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23517)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23518)
- webkitgtk: buffer overflow issue was addressed with improved memory handling (CVE-2022-32886)
- webkitgtk: out-of-bounds write issue was addressed with improved bounds checking (CVE-2022-32888)
- webkitgtk: correctness issue in the JIT was addressed with improved checks (CVE-2022-32923)
- webkitgtk: issue was addressed with improved UI handling (CVE-2022-42799)
- webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2022-42823)
- webkitgtk: sensitive information disclosure issue (CVE-2022-42824)
- webkitgtk: memory disclosure issue was addressed with improved memory handling (CVE-2022-42852)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-42863)
- webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42867)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46691)
- webkitgtk: Same Origin Policy bypass issue (CVE-2022-46692)
- webkitgtk: logic issue leading to user information disclosure (CVE-2022-46698)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46699)
- webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46700)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild() (CVE-2023-25358)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::renderer() (CVE-2023-25360)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::setNextSibling() (CVE-2023-25361)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps() (CVE-2023-25362)
- webkitgtk: heap-use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags() (CVE-2023-25363)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2023:2834- Updated
- 2026-11-02
OSVMGASA-2023-0177 No score
Updated webkit2 packages fix security vulnerability
HTML document may be able to render iframes with sensitive user information (CVE-2022-0108) maliciously crafted web content may lead to arbitrary code execution. (CVE-2022-32885) use-after-free vulnerability exists in WebCore::RenderLayer. This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. (CVE-2023-25358) maliciously crafted web content may bypass Same Origin Policy (CVE-2023-27932) Website may be able to track sensitive user information. Description: The issue was addressed by removing origin information. (CVE-2023-27954) maliciously crafted web content may lead to arbitrary code execution (CVE-2023-28205)
- Record
MGASA-2023-0177- Updated
- 2026-11-02
OSVSUSE-SU-2023:2056-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.6 (bsc#1210731):
- CVE-2022-0108: Fixed information leak.
- CVE-2022-32885: Fixed arbitrary code execution.
- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
- CVE-2023-27932: Fixed Same Origin Policy bypass.
- CVE-2023-27954: Fixed sensitive user information tracking.
- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).
Already fixed in version 2.38.5:
- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.
- Record
SUSE-SU-2023:2056-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2065-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.6 (bsc#1210731):
- CVE-2022-0108: Fixed information leak.
- CVE-2022-32885: Fixed arbitrary code execution.
- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
- CVE-2023-27932: Fixed Same Origin Policy bypass.
- CVE-2023-27954: Fixed sensitive user information tracking.
- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).
Already fixed in version 2.38.5:
- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.
- Record
SUSE-SU-2023:2065-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2077-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues: Update to version 2.38.6 (bsc#1210731):
- CVE-2022-0108: Fixed information leak.
- CVE-2022-32885: Fixed arbitrary code execution.
- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
- CVE-2023-27932: Fixed Same Origin Policy bypass.
- CVE-2023-27954: Fixed sensitive user information tracking.
- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).
Already fixed in version 2.38.5:
- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.
- Record
SUSE-SU-2023:2077-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2078-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
Update to version 2.38.6 (bsc#1210731):
- CVE-2022-0108: Fixed information leak.
- CVE-2022-32885: Fixed arbitrary code execution.
- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
- CVE-2023-27932: Fixed Same Origin Policy bypass.
- CVE-2023-27954: Fixed sensitive user information tracking.
- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).
Already fixed in version 2.38.5:
- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.
- Record
SUSE-SU-2023:2078-1- Updated
- 2026-11-02
OSVUSN-6061-1 No score
webkit2gtk vulnerabilities
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
- Record
USN-6061-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2gtk3AlmaLinux:9 From an advisory covering 22 CVEs |
before 2.38.5-1.el9 | 2.38.5-1.el9 |
webkit2gtk3-develAlmaLinux:9 From an advisory covering 22 CVEs |
before 2.38.5-1.el9 | 2.38.5-1.el9 |
webkit2gtk3-jscAlmaLinux:9 From an advisory covering 22 CVEs |
before 2.38.5-1.el9 | 2.38.5-1.el9 |
webkit2gtk3-jsc-develAlmaLinux:9 From an advisory covering 22 CVEs |
before 2.38.5-1.el9 | 2.38.5-1.el9 |
webkit2gtk3AlmaLinux:8 From an advisory covering 22 CVEs |
before 2.38.5-1.el8 | 2.38.5-1.el8 |
webkit2gtk3-develAlmaLinux:8 From an advisory covering 22 CVEs |
before 2.38.5-1.el8 | 2.38.5-1.el8 |
webkit2gtk3-jscAlmaLinux:8 From an advisory covering 22 CVEs |
before 2.38.5-1.el8 | 2.38.5-1.el8 |
webkit2gtk3-jsc-develAlmaLinux:8 From an advisory covering 22 CVEs |
before 2.38.5-1.el8 | 2.38.5-1.el8 |
webkit2gtkDebian:12 |
before 2.38.0-1 | 2.38.0-1 |
webkit2gtkDebian:13 |
before 2.38.0-1 | 2.38.0-1 |
Show 80 moreShow less
| Package | Affected | Fixed |
|---|---|---|
webkit2gtkDebian:14 |
before 2.38.0-1 | 2.38.0-1 |
wpewebkitDebian:12 |
before 2.38.0-1 | 2.38.0-1 |
wpewebkitDebian:13 |
before 2.38.0-1 | 2.38.0-1 |
wpewebkitDebian:14 |
before 2.38.0-1 | 2.38.0-1 |
webkit2gtkDebian:10 From an advisory covering 10 CVEs |
before 2.38.0-1~deb10u1, plus listed versions 2.24.2-12.24.2-22.24.3-12.24.3-1~bpo10+12.24.3-1~bpo9+1 Show 45 moreShow less2.24.3-1~deb10u12.24.4-12.24.4-1~bpo10+12.24.4-1~bpo9+12.24.4-1~deb10u12.25.1-12.25.2-12.25.4-12.25.92-12.26.0-12.26.1-12.26.1-22.26.1-32.26.1-3~bpo10+12.26.1-3~bpo9+12.26.1-3~bpo9+22.26.1-3~deb10u12.26.2-12.26.2-1~bpo9+12.26.2-1~deb10+12.26.3-12.26.3-1~bpo10+12.26.3-1~bpo9+12.26.3-1~deb10u12.26.4-12.26.4-1~bpo9+12.26.4-1~bpo9+22.26.4-1~bpo9+32.26.4-1~deb10u12.26.4-1~deb10u22.26.4-1~deb10u32.27.1-12.27.2-12.27.3-12.27.4-12.27.90-12.27.91-12.28.0-12.28.0-22.28.0-2~bpo10+12.28.1-12.28.1-22.28.1-2~bpo10+12.28.2-12.28.2-2 |
2.38.0-1~deb10u1 |
webkit2gtkDebian:11 From an advisory covering 12 CVEs |
before 2.38.0-1~deb11u1, plus listed versions 2.32.3-12.32.4-12.32.4-1~deb10u12.32.4-1~deb11u12.33.1-1 Show 45 moreShow less2.33.2-12.33.3-12.33.90-12.33.91-12.34.0-12.34.0-1~bpo11+12.34.1-12.34.1-1~deb10u12.34.1-1~deb11u12.34.2-12.34.2-1~bpo11+12.34.3-12.34.3-1~deb10u12.34.3-1~deb11u12.34.4-12.34.4-1~deb10u12.34.4-1~deb11u12.34.5-12.34.6-12.34.6-1~deb10u12.34.6-1~deb11u12.35.1-12.35.2-12.35.3-12.35.90-12.36.0-12.36.0-22.36.0-32.36.0-3~deb10u12.36.0-3~deb11u12.36.1-12.36.2-12.36.3-12.36.3-1~deb10u12.36.3-1~deb11u12.36.4-12.36.4-1~deb10u12.36.4-1~deb11u12.36.6-12.36.6-1~deb10u12.36.6-1~deb11u12.36.7-12.36.7-1~deb10u12.36.7-1~deb11u12.37.1-1 |
2.38.0-1~deb11u1 |
wpewebkitDebian:11 From an advisory covering 12 CVEs |
before 2.38.0-1~deb11u1, plus listed versions 2.32.3-22.32.4-12.32.4-1~deb11u12.34.1-12.34.1-1~deb11u1 Show 20 moreShow less2.34.2-12.34.3-12.34.3-1~deb11u12.34.4-12.34.4-1~deb11u12.34.5-12.34.6-12.34.6-1~deb11u12.36.0-12.36.0-22.36.0-2~deb11u12.36.1-12.36.3-12.36.3-1~deb11u12.36.4-12.36.4-1~deb11u12.36.6-12.36.6-1~deb11u12.36.7-12.36.7-1~deb11u1 |
2.38.0-1~deb11u1 |
webkit2Mageia:8 From an advisory covering 6 CVEs |
before 2.38.6-1.mga8 | 2.38.6-1.mga8 |
webkit2gtk3Red Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3-develRed Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3-jscRed Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el9 | 0:2.38.5-1.el9 |
webkit2gtk3Red Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkit2gtk3-develRed Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkit2gtk3-jscRed Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 23 CVEs |
before 0:2.38.5-1.el8 | 0:2.38.5-1.el8 |
webkitgtk4Red Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-debuginfoRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-develRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-jscRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-jsc-develRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-docRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkit2gtk3SUSE:OpenStack Cloud 9 From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 12 CVEs |
before 2.38.6-2.136.1 | 2.38.6-2.136.1 |
webkit2gtk3-soup2SUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 12 CVEs |
before 2.38.6-150400.4.39.1 | 2.38.6-150400.4.39.1 |
webkit2gtk3SUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.38.6-150400.4.39.1 | 2.38.6-150400.4.39.1 |
webkit2gtk4SUSE:Linux Enterprise Module for Development Tools 15 SP4 From an advisory covering 12 CVEs |
before 2.38.6-150400.4.39.1 | 2.38.6-150400.4.39.1 |
webkit2gtk3openSUSE:Leap 15.4 From an advisory covering 12 CVEs |
before 2.38.6-150400.4.39.1 | 2.38.6-150400.4.39.1 |
webkit2gtk3-soup2openSUSE:Leap 15.4 From an advisory covering 12 CVEs |
before 2.38.6-150400.4.39.1 | 2.38.6-150400.4.39.1 |
webkit2gtk4openSUSE:Leap 15.4 From an advisory covering 12 CVEs |
before 2.38.6-150400.4.39.1 | 2.38.6-150400.4.39.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Manager Proxy 4.2 From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Manager Server 4.2 From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Enterprise Storage 7 From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Enterprise Storage 7.1 From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3openSUSE:Leap 15.4 From an advisory covering 12 CVEs |
before 2.38.6-150200.72.1 | 2.38.6-150200.72.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 12 CVEs |
before 2.38.6-150000.3.139.1 | 2.38.6-150000.3.139.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 12 CVEs |
before 2.38.6-150000.3.139.1 | 2.38.6-150000.3.139.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 12 CVEs |
before 2.38.6-150000.3.139.1 | 2.38.6-150000.3.139.1 |
qtwebkit-opensource-srcUbuntu:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1 |
None known |
webkit2gtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1 |
None known |
qtwebkit-sourceUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 |
None known |
webkitgtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1 |
None known |
webkit2gtkUbuntu:18.04:LTS |
All versions, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 33 moreShow less2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.12.22.5-0ubuntu0.18.04.12.22.6-0ubuntu0.18.04.12.24.1-0ubuntu0.18.04.12.24.2-0ubuntu0.18.04.12.24.4-0ubuntu0.18.04.12.26.1-0ubuntu0.18.04.12.26.2-0ubuntu0.18.04.12.26.3-0ubuntu0.18.04.12.26.4-0ubuntu0.18.04.12.28.0-0ubuntu0.18.04.32.28.1-0ubuntu0.18.04.12.28.2-0ubuntu0.18.04.12.28.3-0ubuntu0.18.04.12.28.4-0ubuntu0.18.04.12.30.3-0ubuntu0.18.04.12.30.5-0ubuntu0.18.04.12.30.6-0ubuntu0.18.04.12.32.0-0ubuntu0.18.04.12.32.3-0ubuntu0.18.04.12.32.4-0ubuntu0.18.04.1 |
None known |
qtwebkit-opensource-srcUbuntu:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1 |
None known |
qtwebkit-sourceUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu13 |
None known |
webkitgtkUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3 |
None known |
webkit2gtkUbuntu:20.04:LTS |
before 2.38.6-0ubuntu0.20.04.1, plus listed versions 2.26.1-32.26.2-12.26.3-1ubuntu22.26.4-1ubuntu12.28.0-1ubuntu2 Show 25 moreShow less2.28.1-12.28.2-0ubuntu0.20.04.12.28.3-0ubuntu0.20.04.12.28.4-0ubuntu0.20.04.12.30.3-0ubuntu0.20.04.12.30.5-0ubuntu0.20.04.12.30.6-0ubuntu0.20.04.12.32.0-0ubuntu0.20.04.12.32.3-0ubuntu0.20.04.12.32.4-0ubuntu0.20.04.12.34.1-0ubuntu0.20.04.12.34.3-0ubuntu0.20.04.12.34.4-0ubuntu0.20.04.12.34.6-0ubuntu0.20.04.12.36.0-0ubuntu0.20.04.32.36.2-0ubuntu0.20.04.12.36.3-0ubuntu0.20.04.12.36.4-0ubuntu0.20.04.12.36.6-0ubuntu0.20.04.12.36.7-0ubuntu0.20.04.12.36.8-0ubuntu0.20.04.12.38.2-0ubuntu0.20.04.12.38.3-0ubuntu0.20.04.12.38.4-0ubuntu0.20.04.22.38.5-0ubuntu0.20.04.1 |
2.38.6-0ubuntu0.20.04.1 |
qtwebkit-opensource-srcUbuntu:20.04:LTS |
All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1 |
None known |
wpewebkitUbuntu:20.04:LTS |
All versions, plus listed versions 2.26.3-12.26.4-12.26.4-1build12.28.0-12.28.1-1 |
None known |
qtwebkit-opensource-srcUbuntu:22.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1 |
None known |
webkit2gtkUbuntu:22.04:LTS |
before 2.38.6-0ubuntu0.22.04.1, plus listed versions 2.34.0-1ubuntu12.34.1-1ubuntu12.34.2-1ubuntu12.34.3-12.35.3-1ubuntu1 Show 12 moreShow less2.35.90-1ubuntu12.36.0-2ubuntu12.36.2-0ubuntu0.22.04.12.36.3-0ubuntu0.22.04.12.36.4-0ubuntu0.22.04.12.36.6-0ubuntu0.22.04.12.36.7-0ubuntu0.22.04.12.36.8-0ubuntu0.22.04.12.38.2-0ubuntu0.22.04.22.38.3-0ubuntu0.22.04.12.38.4-0ubuntu0.22.04.12.38.5-0ubuntu0.22.04.1 |
2.38.6-0ubuntu0.22.04.1 |
wpewebkitUbuntu:22.04:LTS |
All versions, plus listed versions 2.32.4-12.34.1-12.34.2-12.34.3-12.34.4-1 Show 4 moreShow less2.34.5-12.34.6-12.36.0-2ubuntu22.36.0-2ubuntu3 |
None known |
qtwebkit-opensource-srcUbuntu:24.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36 |
None known |
webkit2gtkUbuntu:20.04:LTS From an advisory covering 6 CVEs |
before 2.38.6-0ubuntu0.20.04.1, plus listed versions 2.26.1-32.26.2-12.26.3-1ubuntu22.26.4-1ubuntu12.28.0-1ubuntu2 Show 25 moreShow less2.28.1-12.28.2-0ubuntu0.20.04.12.28.3-0ubuntu0.20.04.12.28.4-0ubuntu0.20.04.12.30.3-0ubuntu0.20.04.12.30.5-0ubuntu0.20.04.12.30.6-0ubuntu0.20.04.12.32.0-0ubuntu0.20.04.12.32.3-0ubuntu0.20.04.12.32.4-0ubuntu0.20.04.12.34.1-0ubuntu0.20.04.12.34.3-0ubuntu0.20.04.12.34.4-0ubuntu0.20.04.12.34.6-0ubuntu0.20.04.12.36.0-0ubuntu0.20.04.32.36.2-0ubuntu0.20.04.12.36.3-0ubuntu0.20.04.12.36.4-0ubuntu0.20.04.12.36.6-0ubuntu0.20.04.12.36.7-0ubuntu0.20.04.12.36.8-0ubuntu0.20.04.12.38.2-0ubuntu0.20.04.12.38.3-0ubuntu0.20.04.12.38.4-0ubuntu0.20.04.22.38.5-0ubuntu0.20.04.1 |
2.38.6-0ubuntu0.20.04.1 |
webkit2gtkUbuntu:22.04:LTS From an advisory covering 6 CVEs |
before 2.38.6-0ubuntu0.22.04.1, plus listed versions 2.34.0-1ubuntu12.34.1-1ubuntu12.34.2-1ubuntu12.34.3-12.35.3-1ubuntu1 Show 12 moreShow less2.35.90-1ubuntu12.36.0-2ubuntu12.36.2-0ubuntu0.22.04.12.36.3-0ubuntu0.22.04.12.36.4-0ubuntu0.22.04.12.36.6-0ubuntu0.22.04.12.36.7-0ubuntu0.22.04.12.36.8-0ubuntu0.22.04.12.38.2-0ubuntu0.22.04.22.38.3-0ubuntu0.22.04.12.38.4-0ubuntu0.22.04.12.38.5-0ubuntu0.22.04.1 |
2.38.6-0ubuntu0.22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-25358 is a high vulnerability (CVSS 8.8) in Webkitgtk, published September 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in webkit2gtk 2.38.0-1.
References
bugs.webkit.org/show_bug.cgi?id=242683
openwall.com/lists/oss-security/2023/04/21/3
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QL5OGMSHRQ26FTYWZUXVNWB2VHOSVXK
security.gentoo.org/glsa/202305-32
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-25358
github.com/advisories/GHSA-xcc8-3vrq-wjg2
access.redhat.com/errata/RHSA-2023:2256
bugzilla.redhat.com/2128643
errata.almalinux.org/9/ALSA-2023-2256.html
security-tracker.debian.org/tracker/CVE-2023-25358
advisories.mageia.org/MGASA-2023-0177.html
bugs.mageia.org/show_bug.cgi?id=31854
webkitgtk.org/security/WSA-2023-0003.html
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2256.json
cve.org/CVERecord?id=CVE-2022-32886
cisa.gov/known-exploited-vulnerabilities-catalog
talosintelligence.com/vulnerability_reports/TALOS-2020-1214
wpewebkit.org/security/WSA-2022-0007.html
seclists.org/fulldisclosure/2024/Mar/21
support.apple.com/en-us/120896
suse.com/support/update/announcement/2023/suse-su-20232056-1
bugzilla.suse.com/1210295
ubuntu.com/security/CVE-2023-25358
This page doesn't list everything
Left out here: 93 versions and 886 references. The JSON record has them.