CVE-2022-0108: Inappropriate implementation in Navigation

Reference Links

• https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html (Advisory)
• https://crbug.com/1248444
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QL5OGMSHRQ26FTYWZUXVNWB2VHOSVXK/
• http://www.openwall.com/lists/oss-security/2023/04/21/3
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5OKKVEUQAAGH3NHMX3WHWKRPYU4QFKTQ/
• https://www.debian.org/security/2023/dsa-5396
• https://www.debian.org/security/2023/dsa-5397
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KC7DMUX37BRCLAI4VPQYHDUVEGTNYN5A/
• https://launchpad.net/bugs/cve/CVE-2022-0108
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0108
• https://webkitgtk.org/security/WSA-2023-0003.html
• https://ubuntu.com/security/notices/USN-6061-1
• https://nvd.nist.gov/vuln/detail/CVE-2022-0108
• https://security-tracker.debian.org/tracker/CVE-2022-0108
• https://ubuntu.com/security/CVE-2022-0108
• https://support.apple.com/en-us/HT213638 (Advisory)
• https://lists.debian.org/debian-lts-announce/2023/05/msg00011.html
• https://support.apple.com/en-us/HT213599 (Advisory)
• https://support.apple.com/en-us/HT213605 (Advisory)
• https://support.apple.com/en-us/HT213601 (Advisory)
• https://support.apple.com/en-us/HT213606 (Advisory)
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QL5OGMSHRQ26FTYWZUXVNWB2VHOSVXK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OKKVEUQAAGH3NHMX3WHWKRPYU4QFKTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC7DMUX37BRCLAI4VPQYHDUVEGTNYN5A/

Parent vulnerabilities

(Appears in the following advisories)

• USN-6061-1
• HT213638
• HT213599
• HT213605
• HT213601
• HT213606
• 3758141203538733592

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2023-23518
• CVE-2023-23517
• CVE-2023-23496
• CVE-2022-0108
• CVE-2023-23529
• CVE-2023-32438
• CVE-2023-23499
• CVE-2023-23520
• CVE-2023-41990
• CVE-2023-23519
• CVE-2023-23500
• CVE-2023-23502
• CVE-2023-23504
• CVE-2023-23503
• CVE-2023-23512
• CVE-2023-23505
• CVE-2023-23511
• CVE-2023-32393
• CVE-2022-42915
• CVE-2022-42916
• CVE-2022-32221
• CVE-2022-35260
• CVE-2023-23539
• CVE-2023-23513
• CVE-2023-23493
• CVE-2023-23530
• CVE-2023-23531
• CVE-2023-23507
• CVE-2023-23516
• CVE-2023-23506
• CVE-2023-23498
• CVE-2023-28208
• CVE-2023-23497
• CVE-2023-23510
• CVE-2022-3705
• CVE-2023-23501
• CVE-2023-23508
• CVE-2022-0096
• CVE-2022-0097
• CVE-2022-0098
• CVE-2022-0099
• CVE-2022-0100
• CVE-2022-0101
• CVE-2022-0337
• CVE-2022-0102
• CVE-2022-0103
• CVE-2022-4924
• CVE-2022-0104
• CVE-2022-0105
• CVE-2022-0106
• CVE-2022-0107
• CVE-2022-0109
• CVE-2022-0110
• CVE-2022-0111
• CVE-2022-0112
• CVE-2022-0113
• CVE-2022-0114
• CVE-2022-0115
• CVE-2022-0116
• CVE-2022-0117
• CVE-2022-0118
• CVE-2022-0120
• CVE-2022-4925

Frequently Asked Questions

• What is the vulnerability ID?

  The vulnerability ID is CVE-2022-0108.

• What is the title of the vulnerability?

  The title of the vulnerability is WebKit.

• What is the description of the vulnerability?

  The vulnerability is related to inappropriate implementation in Navigation in Google Chrome prior to version 97.0.4692.71, allowing a remote attacker to leak cross-origin data via a crafted HTML page.

• What software are affected by this vulnerability?

  The following software are affected by this vulnerability: Apple Safari up to version 16.3, Ubuntu Chromium Browser up to version 97.0.4692.71-0ubuntu0.18.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.20.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.22.04.1, Ubuntu Webkit2gtk up to version 2.38.6-0ubuntu0.22.10.1, Ubuntu Webkit2gtk up to version 2.40.1-0ubuntu0.23.04.1, Debian Chromium up to version 90.0.4430.212-1~deb10u1, Debian Webkit2gtk up to version 2.36.4-1~deb10u1, Debian Webkit2gtk up to version 2.38.5-1~deb11u1, Debian Wpewebkit up to version 2.38.5-1~deb11u1, Apple watchOS up to version 9.3, Apple tvOS up to version 16.3, Apple macOS Ventura up to version 13.2, Apple iOS up to version 16.3, and Apple iPadOS up to version 16.3.

• What is the severity of this vulnerability?

  The severity of this vulnerability is not mentioned.

• Is there a fix available for this vulnerability?

  Yes, the fix for this vulnerability is available in Apple Safari version 16.3, Ubuntu Chromium Browser version 97.0.4692.71-0ubuntu0.18.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.20.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.22.04.1, Ubuntu Webkit2gtk version 2.38.6-0ubuntu0.22.10.1, Ubuntu Webkit2gtk version 2.40.1-0ubuntu0.23.04.1, Debian Chromium version 90.0.4430.212-1~deb10u1, Debian Webkit2gtk version 2.36.4-1~deb10u1, Debian Webkit2gtk version 2.38.5-1~deb11u1, Debian Wpewebkit version 2.38.5-1~deb11u1, Apple watchOS version 9.3, Apple tvOS version 16.3, Apple macOS Ventura version 13.2, Apple iOS version 16.3, and Apple iPadOS version 16.3.