CVE-2023-2203: Use After Free
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Other sources
The WebKitGTK flaw CVE-2023-28205 (bug 2185724) was addressed in Red Hat Enterprise Linux 8 via erratum RHSA-2023:1919 and in Red Hat Enterprise Linux 9 via erratum RHSA-2023:1918, released on Apr 20, 2023:
https://access.redhat.com/errata/RHSA-2023:1919 https://access.redhat.com/errata/RHSA-2023:1918
However, the fix for this issue was not included in the WebKitGTK updates released as part of Red Hat Enterprise Linux 8.8 GA erratum (RHSA-2023:2834) and Red Hat Enterprise Linux 9.2 GA erratum (RHSA-2023:2256), causing a security regression of previously released fix. A new CVE-ID CVE-2023-2203 was assigned for this security regression.
Note that this issue and CVE-ID is specific to the WebKitGTK packages as shipped with Red Hat Enterprise Linux and is not applicable to any upstream WebKitGTK version or WebKitGTK packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.
For more information about the original flaw, refer to the CVE page or bug linked above.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-2203?
CVE-2023-2203 is a use-after-free vulnerability found in the WebKitGTK package that allows attackers to execute arbitrary code or cause a denial of service.
Which software versions are affected by CVE-2023-2203?
Versions 2.38.5-1.el8 and 2.38.5-1.el9 of WebKitGTK package, Redhat Enterprise Linux 8.0 and 9.0, and Redhat Enterprise Linux Eus 8.8 and 9.2 are affected by CVE-2023-2203.
What is the severity level of CVE-2023-2203?
CVE-2023-2203 has a severity level of 8.8 (high).
How can I fix CVE-2023-2203?
Apply the necessary updates provided by Red Hat through the official Red Hat Security Advisory RHSA-2023:1919.
What is the Common Weakness Enumeration (CWE) ID associated with CVE-2023-2203?
CVE-2023-2203 is associated with CWE-416 and CWE-20.