{"id":"CVE-2023-25362","aliases":["ALSA-2023:2256","ALSA-2023:2834","DEBIAN-CVE-2023-25362","DLA-3124-1","DSA-5240-1","DSA-5241-1","EUVD-2023-29320","GHSA-wjwh-3f92-h6f4","RHSA-2023:2256","RHSA-2023:2834","SUSE-SU-2023:2056-1","SUSE-SU-2023:2065-1","SUSE-SU-2023:2077-1","SUSE-SU-2023:2078-1","UBUNTU-CVE-2023-25362"],"status":"published","title":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK...","description":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00974,"percentile":0.62332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2022-09-28T00:00:00Z","modified":"2026-10-29T11:30:53Z","fixes":[{"ecosystem":"Debian:12","package":"webkit2gtk","fixed_in":["2.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"webkit2gtk","fixed_in":["2.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"webkit2gtk","fixed_in":["2.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wpewebkit","fixed_in":["2.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wpewebkit","fixed_in":["2.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wpewebkit","fixed_in":["2.38.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.5-1.el9"}]}],"bundled":22},{"source":"osv","ecosystem":"AlmaLinux:9","package":"webkit2gtk3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.5-1.el9"}]}],"bundled":22},{"source":"osv","ecosystem":"AlmaLinux:9","package":"webkit2gtk3-jsc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.5-1.el9"}]}],"bundled":22},{"source":"osv","ecosystem":"AlmaLinux:9","package":"webkit2gtk3-jsc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.5-1.el9"}]}],"bundled":22},{"source":"osv","ecosystem":"AlmaLinux:8","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.5-1.el8"}]}],"bundled":22},{"source":"osv","ecosystem":"AlmaLinux:8","package":"webkit2gtk3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.5-1.el8"}]}],"bundled":22},{"source":"osv","ecosystem":"AlmaLinux:8","package":"webkit2gtk3-jsc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.5-1.el8"}]}],"bundled":22},{"source":"osv","ecosystem":"AlmaLinux:8","package":"webkit2gtk3-jsc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.5-1.el8"}]}],"bundled":22},{"source":"osv","ecosystem":"Debian:12","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wpewebkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wpewebkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wpewebkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1~deb10u1"}]}],"versions":["2.24.2-1","2.24.2-2","2.24.3-1","2.24.3-1~bpo10+1","2.24.3-1~bpo9+1","2.24.3-1~deb10u1","2.24.4-1","2.24.4-1~bpo10+1","2.24.4-1~bpo9+1","2.24.4-1~deb10u1","2.25.1-1","2.25.2-1","2.25.4-1","2.25.92-1","2.26.0-1","2.26.1-1","2.26.1-2","2.26.1-3","2.26.1-3~bpo10+1","2.26.1-3~bpo9+1","2.26.1-3~bpo9+2","2.26.1-3~deb10u1","2.26.2-1","2.26.2-1~bpo9+1","2.26.2-1~deb10+1","2.26.3-1","2.26.3-1~bpo10+1","2.26.3-1~bpo9+1","2.26.3-1~deb10u1","2.26.4-1","2.26.4-1~bpo9+1","2.26.4-1~bpo9+2","2.26.4-1~bpo9+3","2.26.4-1~deb10u1","2.26.4-1~deb10u2","2.26.4-1~deb10u3","2.27.1-1","2.27.2-1","2.27.3-1","2.27.4-1","2.27.90-1","2.27.91-1","2.28.0-1","2.28.0-2","2.28.0-2~bpo10+1","2.28.1-1","2.28.1-2","2.28.1-2~bpo10+1","2.28.2-1","2.28.2-2","2.28.2-2~bpo10+1","2.28.2-2~deb10u1","2.28.3-1","2.28.3-2","2.28.3-2~deb10u1","2.28.4-1","2.28.4-1~deb10u1","2.29.1-1","2.29.2-1","2.29.3-1","2.29.4-1","2.29.91-1","2.29.92-1","2.30.0-1","2.30.1-1","2.30.1-1~bpo10+1","2.30.2-1","2.30.3-1","2.30.3-1+hurd.1","2.30.3-1~deb10u1","2.30.4-1","2.30.4-1~deb10u1","2.30.5-1","2.30.5-1~deb10u1","2.30.6-1","2.30.6-1~deb10u1","2.31.1-1","2.31.90-1","2.31.91-1","2.32.0-1","2.32.0-2","2.32.1-1","2.32.1-1~deb10u1","2.32.1-2","2.32.2-1","2.32.3-1","2.32.3-1~deb10u1","2.32.4-1","2.32.4-1~deb10u1","2.32.4-1~deb11u1","2.33.1-1","2.33.2-1","2.33.3-1","2.33.90-1","2.33.91-1","2.34.0-1","2.34.0-1~bpo11+1","2.34.1-1","2.34.1-1~deb10u1","2.34.1-1~deb11u1","2.34.2-1","2.34.2-1~bpo11+1","2.34.3-1","2.34.3-1~deb10u1","2.34.3-1~deb11u1","2.34.4-1","2.34.4-1~deb10u1","2.34.4-1~deb11u1","2.34.5-1","2.34.6-1","2.34.6-1~deb10u1","2.34.6-1~deb11u1","2.35.1-1","2.35.2-1","2.35.3-1","2.35.90-1","2.36.0-1","2.36.0-2","2.36.0-3","2.36.0-3~deb10u1","2.36.0-3~deb11u1","2.36.1-1","2.36.2-1","2.36.3-1","2.36.3-1~deb10u1","2.36.3-1~deb11u1","2.36.4-1","2.36.4-1~deb10u1","2.36.4-1~deb11u1","2.36.6-1","2.36.6-1~deb10u1","2.36.6-1~deb11u1","2.36.7-1","2.36.7-1~deb10u1","2.36.7-1~deb11u1","2.37.1-1","2.37.1-2","2.37.90-1","2.37.91-1"],"bundled":10},{"source":"osv","ecosystem":"Debian:11","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1~deb11u1"}]}],"versions":["2.32.3-1","2.32.4-1","2.32.4-1~deb10u1","2.32.4-1~deb11u1","2.33.1-1","2.33.2-1","2.33.3-1","2.33.90-1","2.33.91-1","2.34.0-1","2.34.0-1~bpo11+1","2.34.1-1","2.34.1-1~deb10u1","2.34.1-1~deb11u1","2.34.2-1","2.34.2-1~bpo11+1","2.34.3-1","2.34.3-1~deb10u1","2.34.3-1~deb11u1","2.34.4-1","2.34.4-1~deb10u1","2.34.4-1~deb11u1","2.34.5-1","2.34.6-1","2.34.6-1~deb10u1","2.34.6-1~deb11u1","2.35.1-1","2.35.2-1","2.35.3-1","2.35.90-1","2.36.0-1","2.36.0-2","2.36.0-3","2.36.0-3~deb10u1","2.36.0-3~deb11u1","2.36.1-1","2.36.2-1","2.36.3-1","2.36.3-1~deb10u1","2.36.3-1~deb11u1","2.36.4-1","2.36.4-1~deb10u1","2.36.4-1~deb11u1","2.36.6-1","2.36.6-1~deb10u1","2.36.6-1~deb11u1","2.36.7-1","2.36.7-1~deb10u1","2.36.7-1~deb11u1","2.37.1-1","2.37.1-2","2.37.90-1","2.37.91-1","2.38.0-1~deb10u1"],"bundled":12},{"source":"osv","ecosystem":"Debian:11","package":"wpewebkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-1~deb11u1"}]}],"versions":["2.32.3-2","2.32.4-1","2.32.4-1~deb11u1","2.34.1-1","2.34.1-1~deb11u1","2.34.2-1","2.34.3-1","2.34.3-1~deb11u1","2.34.4-1","2.34.4-1~deb11u1","2.34.5-1","2.34.6-1","2.34.6-1~deb11u1","2.36.0-1","2.36.0-2","2.36.0-2~deb11u1","2.36.1-1","2.36.3-1","2.36.3-1~deb11u1","2.36.4-1","2.36.4-1~deb11u1","2.36.6-1","2.36.6-1~deb11u1","2.36.7-1","2.36.7-1~deb11u1"],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3-jsc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3-jsc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3-jsc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"webkit2gtk3-jsc-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el9"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3-jsc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3-jsc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3-jsc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"webkit2gtk3-jsc-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.38.5-1.el8"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-2.136.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"webkit2gtk3-soup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150400.4.39.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150400.4.39.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"webkit2gtk4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150400.4.39.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150400.4.39.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"webkit2gtk3-soup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150400.4.39.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"webkit2gtk4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150400.4.39.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150200.72.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150000.3.139.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150000.3.139.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.6-150000.3.139.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.11-3","2.4.11-3ubuntu2","2.4.11-3ubuntu3"]}],"products":[{"vendor":"webkitgtk","product":"webkitgtk"}],"references":[{"url":"https://bugs.webkit.org/show_bug.cgi?id=244802","tags":["x_transferred","Vendor Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2023/04/21/3","tags":["mailing-list","x_transferred","Mailing List","article"]},{"url":"https://security.gentoo.org/glsa/202305-32","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25362","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wjwh-3f92-h6f4"},{"url":"https://access.redhat.com/errata/RHSA-2023:2256","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32886","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32888","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32923","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42799","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42823","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42824","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42826","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42852","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42863","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42867","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46691","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46692","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46698","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46699","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46700","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23517","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23518","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25358","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25360","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25361","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25362","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25363","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128643","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140501","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140502","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140503","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140504","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140505","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156986","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156987","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156989","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156990","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156991","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156992","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156993","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156994","tags":["report"]},{"url":"https://bugzilla.redhat.com/2167715","tags":["report"]},{"url":"https://bugzilla.redhat.com/2167716","tags":["report"]},{"url":"https://bugzilla.redhat.com/2167717","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175099","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175101","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175103","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175105","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175107","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2256.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2834","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-2834.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-25362","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167716","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175107","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2256.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32886","tags":["advisory"]},{"url":"https://webkitgtk.org/security/WSA-2022-0009.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32888","tags":["advisory"]},{"url":"https://webkitgtk.org/security/WSA-2022-0010.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32923","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32923","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42799","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42799","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42823","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42824","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42826","tags":["advisory"]},{"url":"https://webkitgtk.org/security/WSA-2023-0001.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42852","tags":["advisory"]},{"url":"https://webkitgtk.org/security/WSA-2022-0011.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42863","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42867","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42867","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46691","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46692","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46698","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46699","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46699","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46700","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46700","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-48503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48503","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23517","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23518","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25358","tags":["advisory"]},{"url":"https://bugs.webkit.org/show_bug.cgi?id=242683","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25360","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25360","tags":["advisory"]},{"url":"https://bugs.webkit.org/show_bug.cgi?id=242686","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25361","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25361","tags":["advisory"]},{"url":"https://bugs.webkit.org/show_bug.cgi?id=244249","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25362","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25363","tags":["advisory"]},{"url":"https://bugs.webkit.org/show_bug.cgi?id=242684","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150970","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2834.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210295","tags":["report"]},{"url":"https://bugzilla.suse.com/1210731","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28205","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232065-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232077-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232078-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-25362","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-25362","description":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.","status":"published","published":"2023-03-02T00:00:00Z","modified":"2025-03-07T17:26:32.653Z","updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29320","description":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.","status":"published","published":"2023-03-02T00:00:00Z","modified":"2025-03-07T17:26:32Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-02T20:53:10.661676Z"}],"ghsa":[{"id":"GHSA-wjwh-3f92-h6f4","title":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK...","description":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.","status":"published","published":"2023-03-02T18:30:29Z","modified":"2023-05-30T06:30:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:54:37.218716Z"}],"nvd":[{"id":"CVE-2023-25362","description":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.","status":"published","published":"2023-03-02T16:15:14.57Z","modified":"2026-06-17T05:41:08.74Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"CVE-2023-25362","description":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.","status":"published","published":"2023-03-02T16:15:14.57Z","modified":"2026-03-14T11:59:10.80558Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-25362","description":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.","status":"published","published":"2023-03-02T16:15:14.57Z","modified":"2026-10-26T18:00:36.509692324Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"RHSA-2023:2256","title":"Red Hat Security Advisory: webkit2gtk3 security and bug fix update","status":"published","published":"2024-09-16T09:51:07Z","modified":"2026-06-27T10:16:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2834","title":"Red Hat Security Advisory: webkit2gtk3 security and bug fix update","status":"published","published":"2024-09-16T09:51:17Z","modified":"2026-06-27T10:17:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2023-25362","description":"A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.","status":"published","published":"2023-03-02T16:15:00Z","modified":"2026-04-22T14:02:57.524487Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:2256","title":"Important: webkit2gtk3 security and bug fix update","description":"WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42826)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23517)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23518)\n* webkitgtk: buffer overflow issue was addressed with improved memory handling (CVE-2022-32886)\n* webkitgtk: out-of-bounds write issue was addressed with improved bounds checking (CVE-2022-32888)\n* webkitgtk: correctness issue in the JIT was addressed with improved checks (CVE-2022-32923)\n* webkitgtk: issue was addressed with improved UI handling (CVE-2022-42799)\n* webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2022-42823)\n* webkitgtk: sensitive information disclosure issue (CVE-2022-42824)\n* webkitgtk: memory disclosure issue was addressed with improved memory handling (CVE-2022-42852)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-42863)\n* webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42867)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46691)\n* webkitgtk: Same Origin Policy bypass issue (CVE-2022-46692)\n* webkitgtk: logic issue leading to user information disclosure (CVE-2022-46698)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46699)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46700)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild() (CVE-2023-25358)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::renderer() (CVE-2023-25360)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::setNextSibling() (CVE-2023-25361)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps() (CVE-2023-25362)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags() (CVE-2023-25363)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:53.686144682Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2834","title":"Important: webkit2gtk3 security and bug fix update","description":"WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42826)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23517)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23518)\n* webkitgtk: buffer overflow issue was addressed with improved memory handling (CVE-2022-32886)\n* webkitgtk: out-of-bounds write issue was addressed with improved bounds checking (CVE-2022-32888)\n* webkitgtk: correctness issue in the JIT was addressed with improved checks (CVE-2022-32923)\n* webkitgtk: issue was addressed with improved UI handling (CVE-2022-42799)\n* webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2022-42823)\n* webkitgtk: sensitive information disclosure issue (CVE-2022-42824)\n* webkitgtk: memory disclosure issue was addressed with improved memory handling (CVE-2022-42852)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-42863)\n* webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42867)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46691)\n* webkitgtk: Same Origin Policy bypass issue (CVE-2022-46692)\n* webkitgtk: logic issue leading to user information disclosure (CVE-2022-46698)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46699)\n* webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46700)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild() (CVE-2023-25358)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::renderer() (CVE-2023-25360)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::setNextSibling() (CVE-2023-25361)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps() (CVE-2023-25362)\n* webkitgtk: heap-use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags() (CVE-2023-25363)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:04.518116348Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"DLA-3124-1","title":"webkit2gtk - security update","status":"published","published":"2022-09-29T00:00:00Z","modified":"2026-03-09T01:21:54.461608Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5240-1","title":"webkit2gtk - security update","status":"published","published":"2022-09-28T00:00:00Z","modified":"2026-03-09T02:11:06.297935Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"DSA-5241-1","title":"wpewebkit - security update","status":"published","published":"2022-09-28T00:00:00Z","modified":"2026-03-09T02:11:20.489191Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"SUSE-SU-2023:2056-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 fixes the following issues:\n\nUpdate to version 2.38.6 (bsc#1210731):\n\n- CVE-2022-0108: Fixed information leak.\n- CVE-2022-32885: Fixed arbitrary code execution.\n- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.\n- CVE-2023-27932: Fixed Same Origin Policy bypass.\n- CVE-2023-27954: Fixed  sensitive user information tracking.\n- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295). \n\nAlready fixed in version 2.38.5:\n\n- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.\n","status":"published","published":"2023-04-27T10:05:18Z","modified":"2026-02-04T02:15:00.376921Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2065-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 fixes the following issues:\n\nUpdate to version 2.38.6 (bsc#1210731):\n\n- CVE-2022-0108: Fixed information leak.\n- CVE-2022-32885: Fixed arbitrary code execution.\n- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.\n- CVE-2023-27932: Fixed Same Origin Policy bypass.\n- CVE-2023-27954: Fixed  sensitive user information tracking.\n- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295). \n\nAlready fixed in version 2.38.5:\n\n- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.\n","status":"published","published":"2023-04-28T11:12:33Z","modified":"2026-02-04T03:16:38.574631Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2077-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 fixes the following issues:\nUpdate to version 2.38.6 (bsc#1210731):\n\n- CVE-2022-0108: Fixed information leak.\n- CVE-2022-32885: Fixed arbitrary code execution.\n- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.\n- CVE-2023-27932: Fixed Same Origin Policy bypass.\n- CVE-2023-27954: Fixed  sensitive user information tracking.\n- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295). \n\nAlready fixed in version 2.38.5:\n\n- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.\n","status":"published","published":"2023-04-29T05:06:26Z","modified":"2026-02-04T04:02:26.153027Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2078-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 fixes the following issues:\n\nUpdate to version 2.38.6 (bsc#1210731):\n\n- CVE-2022-0108: Fixed information leak.\n- CVE-2022-32885: Fixed arbitrary code execution.\n- CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.\n- CVE-2023-27932: Fixed Same Origin Policy bypass.\n- CVE-2023-27954: Fixed  sensitive user information tracking.\n- CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295). \n\nAlready fixed in version 2.38.5:\n\n- CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.\n","status":"published","published":"2023-04-29T05:07:42Z","modified":"2026-02-04T04:07:46.147607Z","updated_at":"2026-11-02T15:53:52.350754Z"}]}}