A flaw was found in WebKitGTK. A type confusion issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution.

Reference: https://webkitgtk.org/security/WSA-2020-0008.html

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

A flaw was found in WebKitGTK. An use after free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution.

Reference: https://webkitgtk.org/security/WSA-2020-0008.html

In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

An off by one memory corruption issue exists in WebSocketHandshake::readServerHandshake(). This issue is addressed by improved bounds checking.

References:

Bugzilla: https://bugs.webkit.org/showbug.cgi?id=36339 Trac: http://trac.webkit.org/changeset/56380

Acknowledgements:

Red Hat would like to thank Drew Yao of Apple Product Security for responsibly reporting this issue. Upstream acknowledges Skylined of Google Chrome Security Team as the original reporter.

WebKit. An uncontrolled resource consumption issue was addressed through improved regex processing.

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.

A flaw was found in WebKitGTK. An input validation issue was addressed with improved input validation. Processing maliciously crafted web content may lead to a cross site scripting attack.

Reference: https://webkitgtk.org/security/WSA-2020-0008.html

Out-of-bounds read and integer underflow vulnerability in the GLib remote inspector server of WebKitGTK and WPE WebKit. The WTF::SocketConnection::readMessage() function uses strlen() over framed, peer-controlled data without constraining the scan to the declared bodySize. If a crafted payload omits a NUL terminator within that body, the function reads beyond the frame boundary, causing an out-of-bounds read and UIProcess crash (DoS). In addition, the computed messageNameLength is not validated against bodySize before calculating parametersSize = bodySize - messageNameLength, risking integer underflow. A remote, unauthenticated client can trigger this condition whenever the remote inspector server is enabled and reachable, but the feature is primarily intended for debugging and is disabled by default, which limits practical exposure.

The issue was addressed with improved checks.

Impact: a malicious website may process restricted web content outside the sandbox

Advisory: https://webkitgtk.org/security/WSA-2026-0004.html WebKit Bug: https://bugs.webkit.org/showbug.cgi?id=315004

A type confusion issue was addressed with improved checks.

Impact: maliciously crafted web content may lead to memory corruption

Advisory: https://webkitgtk.org/security/WSA-2026-0004.html WebKit Bug: https://bugs.webkit.org/showbug.cgi?id=314528

A use-after-free issue was addressed with improved memory management.

Impact: maliciously crafted web content may lead to memory corruption

Advisory: https://webkitgtk.org/security/WSA-2026-0004.html WebKit Bug: https://bugs.webkit.org/showbug.cgi?id=313577

The issue was addressed with improved input validation.

Impact: a malicious website may process restricted web content outside the sandbox

Advisory: https://webkitgtk.org/security/WSA-2026-0004.html WebKit Bug: https://bugs.webkit.org/showbug.cgi?id=312832

A use-after-free issue was addressed with improved memory management.

Impact: maliciously crafted web content may lead to memory corruption

Advisory: https://webkitgtk.org/security/WSA-2026-0004.html WebKit Bug: https://bugs.webkit.org/showbug.cgi?id=314115

The WebKitGTK flaw CVE-2023-28205 (bug 2185724) was addressed in Red Hat Enterprise Linux 8 via erratum RHSA-2023:1919 and in Red Hat Enterprise Linux 9 via erratum RHSA-2023:1918, released on Apr 20, 2023:

https://access.redhat.com/errata/RHSA-2023:1919 https://access.redhat.com/errata/RHSA-2023:1918

However, the fix for this issue was not included in the WebKitGTK updates released as part of Red Hat Enterprise Linux 8.8 GA erratum (RHSA-2023:2834) and Red Hat Enterprise Linux 9.2 GA erratum (RHSA-2023:2256), causing a security regression of previously released fix. A new CVE-ID CVE-2023-2203 was assigned for this security regression.

Note that this issue and CVE-ID is specific to the WebKitGTK packages as shipped with Red Hat Enterprise Linux and is not applicable to any upstream WebKitGTK version or WebKitGTK packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.

For more information about the original flaw, refer to the CVE page or bug linked above.

JavaScriptCore in WebKit on Apple iPhone before 2.0 and iPod touch before 2.0 does not properly perform runtime garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors that trigger memory corruption, a different vulnerability than CVE-2008-2317.

WebKit. Multiple memory corruption issues were addressed through improved input validation.

WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service (CPU consumption) via a web page that calls the JavaScript setInterval method, which triggers an incompatibility between the WTF::currentTime and base::Time functions.

xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.

A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to visit a malicious webpage to trigger this vulnerability.

Reference: https://webkitgtk.org/security/WSA-2023-0009.html#CVE-2023-39928

Versions affected: WebKitGTK and WPE WebKit before 2.40.5. Credit to Johan Carlsson (joaxcar). Impact: A remote attacker may be able to cause arbitrary javascript code execution. Description: The issue was addressed with improved checks.

Versions affected: WebKitGTK and WPE WebKit before 2.40.1. Credit to hazbinhotel working with Trend Micro Zero Day Initiative. Impact: Processing web content may lead to arbitrary code execution. Description: A use-after-free issue was addressed with improved memory management.

Versions affected: WebKitGTK and WPE WebKit before 2.40.1. Credit to Gertjan Franken of imec-DistriNet, KU Leuven. Impact: Content Security Policy to block domains with wildcards may fail. Description: A logic issue was addressed with improved validation.

Processing web content may lead to arbitrary code execution. A use-after-free issue was addressed with improved memory management.

Reference: https://webkitgtk.org/security/WSA-2023-0009.html#CVE-2023-39434

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

References: https://bugs.webkit.org/showbug.cgi?id=231479 https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q

A flaw was found in WebKitGTK. A logic issue was addressed with improved restrictions.

References: https://webkitgtk.org/security/WSA-2021-0007.html https://www.openwall.com/lists/oss-security/2021/12/20/6

A flaw was found in WebKitGTK. An use-after-free issue was addressed with improved memory management.

Reference: https://webkitgtk.org/security/WSA-2022-0002.html