Webkitgtk vulnerabilities, page 2
134 vulnerabilities
Known vulnerabilities in Webkitgtk products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Act nowCVE-2023-32439Apple · Multiple Products +13 moreApple Multiple Products WebKit Type Confusion VulnerabilityA type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.CVSS8.8HighKEVEPSS23.97%Act nowCVE-2023-32373Apple · Multiple Products +16 moreApple Multiple Products WebKit Use-After-Free VulnerabilityA use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.CVSS8.8HighKEVEPSS12.17%Act nowCVE-2023-28204Apple · Multiple Products +15 moreApple Multiple Products WebKit Out-of-Bounds Read VulnerabilityAn out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.CVSS6.5MediumKEVEPSS14.29%RoutineCVE-2023-2203redhat · enterprise_linux +14 moreredhat enterprise_linuxA flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.CVSS8.8HighEPSS0.93%Act nowCVE-2019-8720WebKitGTK +28 moreWebKitGTK Memory Corruption VulnerabilityA vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.CVSS8.8HighKEVEPSS1.56%RoutineCVE-2023-25363webkitgtk +3 morewebkitgtk webkitgtkA use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely.CVSS8.8HighEPSS0.97%RoutineCVE-2023-25362webkitgtk +3 morewebkitgtk webkitgtkA use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.CVSS8.8HighEPSS0.97%RoutineCVE-2023-25361webkitgtk +3 morewebkitgtk webkitgtkA use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely.CVSS8.8HighEPSS0.97%RoutineCVE-2023-25360webkitgtk +3 morewebkitgtk webkitgtkA use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely.CVSS8.8HighEPSS0.97%RoutineCVE-2023-25358fedoraproject · fedora +8 morefedoraproject fedoraA use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.CVSS8.8HighEPSS1.06%RoutineCVE-2022-42826apple · macos +11 moreapple macosA use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1 and iPadOS 16, Safari 16.1. Processing maliciously crafted web content may lead to arbitrary code execution.CVSS8.8HighEPSS0.77%Act nowCVE-2022-32893Apple · iOS and macOS +54 moreApple iOS and macOS Out-of-Bounds Write VulnerabilityAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.CVSS8.8HighKEVEPSS9.93%Act nowCVE-2022-2294WebRTC +26 moreWebRTC Heap Buffer Overflow VulnerabilityHeap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVSS8.8HighKEVRansomwareEPSS70.83%PrioritiseCVE-2022-30293debian · debian_linux +9 moredebian debian_linuxIn WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp.CVSS7.5HighEPSS2.22%RoutineCVE-2022-22590apple · ios and ipados +15 moreapple ios and ipadosA use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content may lead to arbitrary code execution.CVSS8.8HighEPSS1.55%RoutineCVE-2021-45481webkitgtk +8 morewebkitgtk webkitgtkIn WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application crash, a different vulnerability than CVE-2021-30889.CVSS6.5MediumEPSS1.53%RoutineCVE-2021-45482webkitgtk +8 morewebkitgtk webkitgtkIn WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889.CVSS6.5MediumEPSS1.53%RoutineCVE-2021-45483webkitgtk +8 morewebkitgtk webkitgtkIn WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-30889.CVSS6.5MediumEPSS1.52%RoutineCVE-2021-42762debian · debian_linux +31 moredebian debian_linuxBubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.CVSS5.3MediumEPSS0.54%Act nowCVE-2021-30952Apple · Multiple Products +19 moreApple Multiple Products Integer Overflow or Wraparound VulnerabilityAn integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.CVSS8.8HighKEVEPSS6.96%