Discover Security Vulnerabilities News

WebKitGTK Arbitrary Code Execution, Info Disclosure Bugs Fixed - Update Now

Brittany Day

1 - 2 min read May 11, 2023

Several high-severity vulnerabilities have been found in the WebKitGTK web engine, including a use after free issue that may have been actively exploited (CVE-2023-28205).

These bugs could result in the exposure of sensitive information and the execution of arbitrary code.

The following vulnerabilities have been discovered in WebKitGTK:

CVE-2022-0108: Luan Herrera discovered that an HTML document may be able to render iframes with sensitive user information.
CVE-2022-32885: P1umer and Q1IQ discovered that processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2023-27932: An anonymous researcher discovered that processing maliciously crafted web content may bypass Same Origin Policy.
CVE-2023-27954: An anonymous researcher discovered that a website may be able to track sensitive user information.
CVE-2023-28205: Clement Lecigne and Donncha O Cearbhaill discovered that processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

With a low attack complexity, no privileges required to exploit, and a high confidentiality, integrity and availability impact, we strongly recommend that all impacted users apply the WebKitGTK updates issued but their distro(s) now to protect against attacks leading to downtime and the compromise of confidential information.

To stay on top of important updates released by the open-source programs and applications you use, be sure to register as a LinuxSecurity user, then subscribe to our Linux Advisory Watch newsletter and customize your advisories for the distro(s) you use. This will enable you to stay up-to-date on the latest, most significant issues impacting the security of your systems.

Follow @LS_Advisories on Twitter for real-time updates on advisories for your distro(s).