CVE-2022-32891: Medium severity Apple tvOS vulnerability
The issue was addressed with improved UI handling. This issue is fixed in Safari 16, tvOS 16, watchOS 9, iOS 16. Visiting a website that frames malicious content may lead to UI spoofing.
Other sources
Versions affected: WebKitGTK and WPE WebKit before 2.36.5. Credit to @realas3617, an anonymous researcher. Impact: Visiting a website that frames malicious content may lead to UI spoofing. Description: The issue was addressed with improved UI handling. https://webkitgtk.org/security/WSA-2022-0009.html
— Red Hat
WebKit. The issue was addressed with improved UI handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tvOSto a version that resolves this vulnerability.Fixed in 16 - Upgrade
Upgrade
Apple iOS, iPadOS, and watchOSto a version that resolves this vulnerability.Fixed in 9 - Upgrade
Upgrade
Safarito a version that resolves this vulnerability.Fixed in 16 - Upgrade
Upgrade
Apple iOS and iPadOSto a version that resolves this vulnerability.Fixed in 16 - Upgrade
Upgrade
debian/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.50.6-1~deb12u2Fixed in 2.50.6-1~deb12u1Fixed in 2.52.6-1~deb13u1Fixed in 2.54.0-1~deb13u3Fixed in 2.52.6-1Fixed in 2.54.2-2 - Upgrade
Upgrade
debian/wpewebkitto a version that resolves this vulnerability.Fixed in 2.38.6-1Fixed in 2.48.3-1Fixed in 2.54.2-1 - Upgrade
Upgrade
debian/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.36.6-1 - Upgrade
Upgrade
debian/wpewebkitto a version that resolves this vulnerability.Fixed in 2.36.6-1 - Upgrade
Upgrade
WebKitGTKto a version that resolves this vulnerability.Fixed in 2.36.5 - Upgrade
Upgrade
WPE WebKitto a version that resolves this vulnerability.Fixed in 2.36.5 - Upgrade
Upgrade
watchOSto a version that resolves this vulnerability.Fixed in 9 - Upgrade
Upgrade
iOSto a version that resolves this vulnerability.Fixed in 16
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2022-42795
- CVE-2022-32907
- CVE-2022-32903
- CVE-2022-1622
- CVE-2022-32913
- CVE-2022-32949
- CVE-2022-32864
- CVE-2022-32866
- CVE-2022-32911
- CVE-2022-32914
- CVE-2022-32908
- CVE-2022-32879
- CVE-2022-32881
- CVE-2021-36690
- CVE-2022-32886
- CVE-2022-32888
- CVE-2022-32912
- CVE-2022-32891
- CVE-2022-46709
- CVE-2022-32925
- CVE-2022-32858
- CVE-2022-32898
- CVE-2022-32899
- CVE-2022-32889
- CVE-2022-32854
- CVE-2022-32928
- CVE-2022-32894
- CVE-2022-32883
- CVE-2022-32870
- CVE-2022-32835
- CVE-2022-32875
- CVE-2022-32893
- CVE-2022-32868
- CVE-2022-32892
- CVE-2022-32833
- CVE-2022-32827
- CVE-2022-32877
- CVE-2022-32909
- CVE-2022-32867
- CVE-2022-32865
- CVE-2022-22643
- CVE-2022-32793
- CVE-2022-26744
- CVE-2022-32887
- CVE-2022-32916
- CVE-2022-32917
- CVE-2022-32918
- CVE-2022-32795
- CVE-2022-42793
- CVE-2022-32872
- CVE-2022-42790
- CVE-2022-32871
- CVE-2022-42791
- CVE-2022-32859
- DLA-3073-1
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-32891.
What software is affected by CVE-2022-32891?
Safari, iOS, tvOS, and watchOS versions up to and exclusive of 16 for Apple products.
What is the severity of CVE-2022-32891?
The severity of CVE-2022-32891 is not specified.
How was CVE-2022-32891 addressed?
CVE-2022-32891 was addressed with improved UI handling.
Where can I find more information about CVE-2022-32891?
You can find more information about CVE-2022-32891 on the following references: [Link 1](https://support.apple.com/en-us/HT213446), [Link 2](https://support.apple.com/en-us/HT213487), [Link 3](https://support.apple.com/en-us/HT213486).