REDHAT-BUG-2188543: Use After Free
The WebKitGTK flaw CVE-2023-28205 (bug 2185724) was addressed in Red Hat Enterprise Linux 8 via erratum RHSA-2023:1919 and in Red Hat Enterprise Linux 9 via erratum RHSA-2023:1918, released on Apr 20, 2023:
https://access.redhat.com/errata/RHSA-2023:1919 https://access.redhat.com/errata/RHSA-2023:1918
However, the fix for this issue was not included in the WebKitGTK updates released as part of Red Hat Enterprise Linux 8.8 GA erratum (RHSA-2023:2834) and Red Hat Enterprise Linux 9.2 GA erratum (RHSA-2023:2256), causing a security regression of previously released fix. A new CVE-ID CVE-2023-2203 was assigned for this security regression.
Note that this issue and CVE-ID is specific to the WebKitGTK packages as shipped with Red Hat Enterprise Linux and is not applicable to any upstream WebKitGTK version or WebKitGTK packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.
For more information about the original flaw, refer to the CVE page or bug linked above.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2188543?
The severity of REDHAT-BUG-2188543 is classified as high due to the use-after-free vulnerability in WebKitGTK.
How do I fix REDHAT-BUG-2188543?
To fix REDHAT-BUG-2188543, update your Red Hat Enterprise Linux or WebKitGTK to the latest patched version.
What products are affected by REDHAT-BUG-2188543?
REDHAT-BUG-2188543 affects Red Hat Enterprise Linux 8 up to version 8.8, Red Hat Enterprise Linux 9 up to version 9.2, and WebKitGTK.
Is there a public exploit for REDHAT-BUG-2188543?
Currently, there is no public exploit available for REDHAT-BUG-2188543, but its high severity warrants prompt attention.
When was REDHAT-BUG-2188543 discovered?
REDHAT-BUG-2188543 was disclosed on May 10, 2023, highlighting a critical flaw in WebKitGTK.