CVE-2023-25358: Use After Free

Q: What is the vulnerability ID for this use-after-free vulnerability?

The vulnerability ID for this use-after-free vulnerability is CVE-2023-25358.

Q: What is the severity of CVE-2023-25358?

The severity of CVE-2023-25358 is not specified in the provided information.

Q: How does the use-after-free vulnerability in WebCore::RenderLayer::addChild allow attackers to execute code remotely?

The use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK allows attackers to execute code remotely by manipulating memory after it has been freed.

Q: Which versions of WebKitGTK are affected by CVE-2023-25358?

The versions of WebKitGTK affected by CVE-2023-25358 are before 2.36.8.

Q: What are the recommended versions of WebKitGTK to fix CVE-2023-25358?

The recommended versions of WebKitGTK to fix CVE-2023-25358 are 2.38.5-1~deb10u1, 2.38.5-1~deb11u1, 2.40.1-1~deb11u1, and 2.40.1-1.

Published Mar 2, 2023

Updated

A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

Affected Software

8 affected componentsFixes available

ubuntu/webkit2gtk<2.38.6-0ubuntu0.20.04.1

2.38.6-0ubuntu0.20.04.1

ubuntu/webkit2gtk<2.38.6-0ubuntu0.22.04.1

2.38.6-0ubuntu0.22.04.1

ubuntu/webkit2gtk<2.38.6-0ubuntu0.22.10.1

2.38.6-0ubuntu0.22.10.1

WebKitGTK WebKitGTK<2.36.8

Fedoraproject Fedora=38

redhat/webkitgtk<2.36.8

2.36.8

debian/webkit2gtk

2.50.6-1~deb12u22.50.6-1~deb12u12.52.6-1~deb13u12.54.0-1~deb13u32.52.6-12.54.2-2

debian/wpewebkit

2.38.6-12.48.3-12.54.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.38.6-0ubuntu0.20.04.1
Upgrade
Upgrade ubuntu/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.38.6-0ubuntu0.22.04.1
Upgrade
Upgrade ubuntu/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.38.6-0ubuntu0.22.10.1
Upgrade
Upgrade redhat/webkitgtk to a version that resolves this vulnerability.
Fixed in 2.36.8
Upgrade
Upgrade debian/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.50.6-1~deb12u2Fixed in 2.50.6-1~deb12u1Fixed in 2.52.6-1~deb13u1Fixed in 2.54.0-1~deb13u3Fixed in 2.52.6-1Fixed in 2.54.2-2
Upgrade
Upgrade debian/wpewebkit to a version that resolves this vulnerability.
Fixed in 2.38.6-1Fixed in 2.48.3-1Fixed in 2.54.2-1

Event History

Mar 2, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Mar 3, 2023

Data Sourced

via Red Hat·08:25 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3124-1

Frequently Asked Questions

What is the vulnerability ID for this use-after-free vulnerability?