CVE-2023-39928
Red Hat Security Advisory: webkitgtk4 security update
Description
A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability.
Metrics
Weakness classes (CWE)
CWE-416Variant
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
cwe.mitre.org →
Affected operating systems
linux
debian / debian_linux10.0
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
redhat / enterprise_linux6.0
linux
redhat / enterprise_linux7.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
macos
apple / mac_os_x10.14.6
macos
apple / mac_os_x10.15.7
macos
apple / mac_os_x
macos
apple / macos
macos
apple / visionos
mobile
apple / iphone_os
other
fedoraproject / fedora32
other
fedoraproject / fedora33
other
fedoraproject / fedora35
other
fedoraproject / fedora36
other
fedoraproject / fedora37
other
fedoraproject / fedora38
other
fedoraproject / fedora39
other
fedoraproject / fedora40
other
apple / ipados
other
apple / tvos
other
apple / watchos
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
apple
safari14.1
apple
safari14.1.1
apple
safari15.3
apple
safari15.6
apple
safari15.6.1
apple
safari16.0
apple
safari16.2
apple
safari16.3
apple
safari16.4
apple
safari16.4.1
apple
safari16.5
apple
safari16.5.1
apple
safari16.5.2
apple
safari17.0
apple
safari17.1.2
apple
safari17.2
apple
safari17.6
apple
safari18.0
apple
safari18.2
apple
safari18.4
bitnami
jre1.9.0
google
chrome124.0.6367.155
google
chrome35.0.1916.113
google
chrome
References & sources
- https://support.apple.com/en-us/120949
- https://support.apple.com/en-us/120950
- https://support.apple.com/en-us/120948
- https://support.apple.com/en-us/120947
- https://support.apple.com/en-us/120330
- https://support.apple.com/en-us/HT213938
- https://support.apple.com/en-us/HT213936
- https://support.apple.com/en-us/HT213941
- https://support.apple.com/en-us/HT213940
- https://support.apple.com/en-us/HT213937
- http://www.openwall.com/lists/oss-security/2023/09/28/3
- http://seclists.org/fulldisclosure/2023/Oct/2
- http://seclists.org/fulldisclosure/2023/Oct/10
- http://seclists.org/fulldisclosure/2023/Oct/8
- http://seclists.org/fulldisclosure/2023/Oct/9
- http://seclists.org/fulldisclosure/2023/Oct/3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/
- https://security.gentoo.org/glsa/202401-33
- https://webkitgtk.org/security/WSA-2023-0009.html
- https://support.apple.com/en-us/HT213053x_refsource_MISC
Linked CVEs
- CVE-2025-43480
The issue was addressed with improved checks.
— - CVE-2025-31257
This issue was addressed with improved memory handling.
mediumCVSSv3 4.7 - CVE-2025-31215
The issue was addressed with improved checks.
— - CVE-2025-31206
A type confusion issue was addressed with improved state handling.
— - CVE-2025-31205
The issue was addressed with improved checks.
— - CVE-2025-31204
The issue was addressed with improved memory handling.
— - CVE-2025-30427
A use-after-free issue was addressed with improved memory management.
— - CVE-2025-24264
The issue was addressed with improved memory handling.
— - CVE-2025-24223
The issue was addressed with improved memory handling.
— - CVE-2025-24216
The issue was addressed with improved memory handling.
— - CVE-2025-24213
This issue was addressed with improved handling of floats.
— - CVE-2025-24209
A buffer overflow issue was addressed with improved memory handling.
— - CVE-2025-24208
A permissions issue was addressed with additional restrictions.
mediumCVSSv3 6.1 - CVE-2025-24201Actively exploited
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.
critical - CVE-2025-24162
This issue was addressed through improved state management.
— - CVE-2025-24158
The issue was addressed with improved memory handling.
mediumCVSSv3 6.5 - CVE-2025-24150
A privacy issue was addressed with improved handling of files.
— - CVE-2025-24143
The issue was addressed with improved access restrictions to the file system.
— - CVE-2024-54658
The issue was addressed with improved memory handling.
— - CVE-2024-54551
The issue was addressed with improved memory handling.
— - CVE-2024-54543
The issue was addressed with improved memory handling.
— - CVE-2024-54534
The issue was addressed with improved memory handling.
— - CVE-2024-54508
The issue was addressed with improved memory handling.
highCVSSv3 7.5 - CVE-2024-54505
A type confusion issue was addressed with improved memory handling.
—
Show 205 more CVEs
- CVE-2024-54502
The issue was addressed with improved checks.
— - CVE-2024-54479
The issue was addressed with improved checks.
— - CVE-2024-54467
A cookie management issue was addressed with improved state management.
— - CVE-2024-4558
Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a c…
criticalCVSSv3 9.6 - CVE-2024-44309Actively exploited
A cookie management issue was addressed with improved state management.
critical - CVE-2024-44308Actively exploited
The issue was addressed with improved checks.
critical - CVE-2024-44296
The issue was addressed with improved checks.
— - CVE-2024-44244
A memory corruption issue was addressed with improved input validation.
— - CVE-2024-44192
The issue was addressed with improved checks.
— - CVE-2024-44187
A cross-origin issue existed with "iframe" elements.
— - CVE-2024-44185
The issue was addressed with improved checks.
— - CVE-2024-40866
The issue was addressed with improved UI.
mediumCVSSv3 6.5 - CVE-2024-40789
An out-of-bounds access issue was addressed with improved bounds checking.
— - CVE-2024-40782
A use-after-free issue was addressed with improved memory management.
— - CVE-2024-40780
An out-of-bounds read was addressed with improved bounds checking.
— - CVE-2024-40779
An out-of-bounds read was addressed with improved bounds checking.
— - CVE-2024-40776
A use-after-free issue was addressed with improved memory management.
— - CVE-2024-27856
The issue was addressed with improved checks.
— - CVE-2024-27851
The issue was addressed with improved bounds checks.
— - CVE-2024-27838
The issue was addressed by adding additional logic.
— - CVE-2024-27834
The issue was addressed with improved checks.
— - CVE-2024-27833
An integer overflow was addressed with improved input validation.
— - CVE-2024-27820
The issue was addressed with improved memory handling.
— - CVE-2024-27808
The issue was addressed with improved memory handling.
— - CVE-2024-23284
A logic issue was addressed with improved state management.
— - CVE-2024-23280
An injection issue was addressed with improved validation.
— - CVE-2024-23271
A logic issue was addressed with improved checks.
— - CVE-2024-23263
A logic issue was addressed with improved validation.
— - CVE-2024-23254
The issue was addressed with improved UI handling.
— - CVE-2024-23252
No description is available for this CVE.
— - CVE-2024-23222Actively exploited
A type confusion issue was addressed with improved checks.
critical - CVE-2024-23213
The issue was addressed with improved memory handling.
— - CVE-2023-43010
The issue was addressed with improved memory handling.
highCVSSv3 8.8 - CVE-2023-43000Actively exploited
A use-after-free issue was addressed with improved memory management.
critical - CVE-2023-42970
A use-after-free issue was addressed with improved memory management.
— - CVE-2023-42956
The issue was addressed with improved memory handling.
— - CVE-2023-42950
A use after free issue was addressed with improved memory management.
highCVSSv3 8.8 - CVE-2023-42917Actively exploited
A memory corruption vulnerability was addressed with improved locking.
criticalCVSSv3 8.8 - CVE-2023-42916Actively exploited
An out-of-bounds read was addressed with improved input validation.
criticalCVSSv3 6.5 - CVE-2023-42890
The issue was addressed with improved memory handling.
— - CVE-2023-42883
The issue was addressed with improved memory handling.
— - CVE-2023-42875
Processing web content may lead to arbitrary code execution.
— - CVE-2023-42852
A logic issue was addressed with improved checks.
— - CVE-2023-42843
An inconsistent user interface issue was addressed with improved state management.
— - CVE-2023-42833
A correctness issue was addressed with improved checks.
highCVSSv3 8.8 - CVE-2023-41993Actively exploited
The issue was addressed with improved checks.
criticalCVSSv3 8.8 - CVE-2023-41983
The issue was addressed with improved memory handling.
— - CVE-2023-41074
The issue was addressed with improved checks.
— - CVE-2023-40451
This issue was addressed with improved iframe sandbox enforcement.
— - CVE-2023-40414
A use-after-free issue was addressed with improved memory management.
criticalCVSSv3 9.8 - CVE-2023-40397
The issue was addressed with improved checks.
— - CVE-2023-38611
The issue was addressed with improved memory handling.
— - CVE-2023-38600
The issue was addressed with improved checks.
— - CVE-2023-38599
A logic issue was addressed with improved state management.
— - CVE-2023-38597
The issue was addressed with improved checks.
— - CVE-2023-38595
The issue was addressed with improved checks.
— - CVE-2023-38594
The issue was addressed with improved checks.
— - CVE-2023-38592
A logic issue was addressed with improved restrictions.
— - CVE-2023-38572
The issue was addressed with improved checks.
— - CVE-2023-38133
The issue was addressed with improved checks.
— - CVE-2023-37450Actively exploited
The issue was addressed with improved checks.
criticalCVSSv3 8.8 - CVE-2023-35074
The issue was addressed with improved memory handling.
— - CVE-2023-32439Actively exploited
A type confusion issue was addressed with improved checks.
criticalCVSSv3 8.8 - CVE-2023-32435Actively exploited
A memory corruption issue was addressed with improved state management.
criticalCVSSv3 8.8 - CVE-2023-32393
The issue was addressed with improved memory handling.
— - CVE-2023-32373Actively exploited
A use-after-free issue was addressed with improved memory management.
criticalCVSSv3 8.8 - CVE-2023-32370
A logic issue was addressed with improved validation.
— - CVE-2023-32359
This issue was addressed with improved redaction of sensitive information.
— - CVE-2023-28205Actively exploited
A use after free issue was addressed with improved memory management.
criticalCVSSv3 8.8 - CVE-2023-28204Actively exploited
An out-of-bounds read was addressed with improved input validation.
criticalCVSSv3 6.5 - CVE-2023-28198
A use-after-free issue was addressed with improved memory management.
— - CVE-2023-27954
The issue was addressed by removing origin information.
— - CVE-2023-27932
This issue was addressed with improved state management.
— - CVE-2023-25358
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
— - CVE-2023-23529Actively exploited
A type confusion issue was addressed with improved checks.
criticalCVSSv3 8.8 - CVE-2023-23518
The issue was addressed with improved memory handling.
— - CVE-2023-23517
The issue was addressed with improved memory handling.
— - CVE-2022-48503Actively exploited
The issue was addressed with improved bounds checks.
criticalCVSSv3 8.8 - CVE-2022-46725
A spoofing issue existed in the handling of URLs.
— - CVE-2022-46705
A spoofing issue existed in the handling of URLs.
— - CVE-2022-46700
A memory corruption issue was addressed with improved input validation.
— - CVE-2022-46699
A memory corruption issue was addressed with improved state management.
— - CVE-2022-46698
A logic issue was addressed with improved checks.
— - CVE-2022-46692
A logic issue was addressed with improved state management.
— - CVE-2022-46691
A memory consumption issue was addressed with improved memory handling.
— - CVE-2022-42867
A use after free issue was addressed with improved memory management.
— - CVE-2022-42863
A memory corruption issue was addressed with improved state management.
— - CVE-2022-42856Actively exploited
A type confusion issue was addressed with improved state handling.
criticalCVSSv3 8.8 - CVE-2022-42852
The issue was addressed with improved memory handling.
— - CVE-2022-42826
A use after free issue was addressed with improved memory management.
— - CVE-2022-42824
A logic issue was addressed with improved state management.
— - CVE-2022-42823
A type confusion issue was addressed with improved memory handling.
— - CVE-2022-42799
The issue was addressed with improved UI handling.
— - CVE-2022-32933
An information disclosure issue was addressed by removing the vulnerable code.
— - CVE-2022-32923
A correctness issue in the JIT was addressed with improved checks.
— - CVE-2022-32919
The issue was addressed with improved UI handling.
mediumCVSSv3 4.7 - CVE-2022-32912
An out-of-bounds read was addressed with improved bounds checking.
highCVSSv3 8.8 - CVE-2022-32893Actively exploited
An out-of-bounds write issue was addressed with improved bounds checking.
criticalCVSSv3 8.8 - CVE-2022-32891
The issue was addressed with improved UI handling.
— - CVE-2022-32888
An out-of-bounds write issue was addressed with improved bounds checking.
— - CVE-2022-32886
A buffer overflow issue was addressed with improved memory handling.
highCVSSv3 8.8 - CVE-2022-32885
A memory corruption issue was addressed with improved validation.
— - CVE-2022-32816
The issue was addressed with improved UI handling.
— - CVE-2022-32792
An out-of-bounds write issue was addressed with improved input validation.
— - CVE-2022-30294
[REJECTED CVE] In WebKitGTK through 2.36.0 (and WPE WebKit), there is a use-after-free in WebCore::TextureMapperLayer::setContentsLayer i…
— - CVE-2022-30293
In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in W…
— - CVE-2022-26719
A memory corruption issue was addressed with improved state management.
— - CVE-2022-26717
A use after free issue was addressed with improved memory management.
— - CVE-2022-26716
A memory corruption issue was addressed with improved state management.
— - CVE-2022-26710
A use after free issue was addressed with improved memory management.
— - CVE-2022-26709
A use after free issue was addressed with improved memory management.
— - CVE-2022-26700
A memory corruption issue was addressed with improved state management.
— - CVE-2022-22677
A logic issue in the handling of concurrent media was addressed with improved state handling.
— - CVE-2022-22662
A cookie management issue was addressed with improved state management.
— - CVE-2022-22637
A logic issue was addressed with improved state management.
— - CVE-2022-22629
A buffer overflow issue was addressed with improved memory handling.
— - CVE-2022-22628
A use after free issue was addressed with improved memory management.
— - CVE-2022-22624
A use after free issue was addressed with improved memory management.
— - CVE-2022-22620Actively exploited
A use after free issue was addressed with improved memory management.
criticalCVSSv3 8.8 - CVE-2022-22594
A cross-origin issue in the IndexDB API was addressed with improved input validation.
— - CVE-2022-22592
A logic issue was addressed with improved state management.
— - CVE-2022-22590
A use after free issue was addressed with improved memory management.
— - CVE-2022-22589
A validation issue was addressed with improved input sanitization.
— - CVE-2022-0108
Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via…
— - CVE-2021-45483
In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-30889.
— - CVE-2021-45482
In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889.
— - CVE-2021-45481
In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a se…
— - CVE-2021-42762
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick…
— - CVE-2021-30984
A race condition was addressed with improved state handling.
— - CVE-2021-30954
A type confusion issue was addressed with improved memory handling.
— - CVE-2021-30953
An out-of-bounds read was addressed with improved bounds checking.
— - CVE-2021-30952Actively exploited
An integer overflow was addressed with improved input validation.
critical - CVE-2021-30951
A use after free issue was addressed with improved memory management.
— - CVE-2021-30936
A use after free issue was addressed with improved memory management.
— - CVE-2021-30934
A buffer overflow issue was addressed with improved memory handling.
— - CVE-2021-30897
An issue existed in the specification for the resource timing API.
— - CVE-2021-30890
A logic issue was addressed with improved state management.
— - CVE-2021-30889
A buffer overflow issue was addressed with improved memory handling.
— - CVE-2021-30888
An information leakage issue was addressed.
— - CVE-2021-30887
A logic issue was addressed with improved restrictions.
— - CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing.
— - CVE-2021-30851
A memory corruption vulnerability was addressed with improved locking.
— - CVE-2021-30849
Multiple memory corruption issues were addressed with improved memory handling.
— - CVE-2021-30848
A memory corruption issue was addressed with improved memory handling.
— - CVE-2021-30846
A memory corruption issue was addressed with improved memory handling.
— - CVE-2021-30836
An out-of-bounds read was addressed with improved input validation.
— - CVE-2021-30823
A logic issue was addressed with improved restrictions.
— - CVE-2021-30818
A type confusion issue was addressed with improved state handling.
— - CVE-2021-30809
A use after free issue was addressed with improved memory management.
— - CVE-2021-30799
Multiple memory corruption issues were addressed with improved memory handling.
— - CVE-2021-30797
This issue was addressed with improved checks.
— - CVE-2021-30795
A use after free issue was addressed with improved memory management.
— - CVE-2021-30762Actively exploited
A use after free issue was addressed with improved memory management.
criticalCVSSv3 8.8 - CVE-2021-30761Actively exploited
A memory corruption issue was addressed with improved state management.
criticalCVSSv3 8.8 - CVE-2021-30758
A type confusion issue was addressed with improved state handling.
— - CVE-2021-30749
Multiple memory corruption issues were addressed with improved memory handling.
— - CVE-2021-30744
Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins.
— - CVE-2021-30734
Multiple memory corruption issues were addressed with improved memory handling.
— - CVE-2021-30720
A logic issue was addressed with improved restrictions.
— - CVE-2021-30689
A logic issue was addressed with improved state management.
— - CVE-2021-30682
A logic issue was addressed with improved restrictions.
— - CVE-2021-30666Actively exploited
A buffer overflow issue was addressed with improved memory handling.
criticalCVSSv3 8.8 - CVE-2021-30665Actively exploited
A memory corruption issue was addressed with improved state management.
criticalCVSSv3 8.8 - CVE-2021-30663Actively exploited
An integer overflow was addressed with improved input validation.
criticalCVSSv3 8.8 - CVE-2021-30661Actively exploited
A use after free issue was addressed with improved memory management.
criticalCVSSv3 8.8 - CVE-2021-21806
An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64.
highCVSSv3 8.8 - CVE-2021-21779
A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4.
mediumCVSSv3 6.8 - CVE-2021-21775
A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4.
mediumCVSSv3 6.8 - CVE-2021-1871Actively exploited
A logic issue was addressed with improved restrictions.
criticalCVSSv3 9.8 - CVE-2021-1870Actively exploited
A logic issue was addressed with improved restrictions.
criticalCVSSv3 9.8 - CVE-2021-1844
A memory corruption issue was addressed with improved validation.
— - CVE-2021-1826
A logic issue was addressed with improved restrictions.
— - CVE-2021-1825
An input validation issue was addressed with improved input validation.
— - CVE-2021-1820
A memory initialization issue was addressed with improved memory handling.
— - CVE-2021-1817
A memory corruption issue was addressed with improved state management.
— - CVE-2021-1801
This issue was addressed with improved iframe sandbox enforcement.
— - CVE-2021-1799
A port redirection issue was addressed with additional port validation.
— - CVE-2021-1789Actively exploited
A type confusion issue was addressed with improved state handling.
criticalCVSSv3 8.8 - CVE-2021-1788
A use after free issue was addressed with improved memory management.
— - CVE-2021-1765
This issue was addressed with improved iframe sandbox enforcement.
— - CVE-2020-9983
An out-of-bounds write issue was addressed with improved bounds checking.
— - CVE-2020-9952
An input validation issue was addressed with improved input validation.
— - CVE-2020-9951
A use after free issue was addressed with improved memory management.
— - CVE-2020-9948
A type confusion issue was addressed with improved memory handling.
— - CVE-2020-9947
A use after free issue was addressed with improved memory management.
— - CVE-2020-9925
A logic issue was addressed with improved state management.
— - CVE-2020-9915
An access issue existed in Content Security Policy.
— - CVE-2020-9895
A use after free issue was addressed with improved memory management.
— - CVE-2020-9894
An out-of-bounds read was addressed with improved input validation.
— - CVE-2020-9893
A use after free issue was addressed with improved memory management.
— - CVE-2020-9862
A command injection issue existed in Web Inspector.
— - CVE-2020-9850
A logic issue was addressed with improved restrictions.
— - CVE-2020-9843
An input validation issue was addressed with improved input validation.
— - CVE-2020-9807
A memory corruption issue was addressed with improved state management.
— - CVE-2020-9806
A memory corruption issue was addressed with improved state management.
— - CVE-2020-9805
A logic issue was addressed with improved restrictions.
— - CVE-2020-9803
A memory corruption issue was addressed with improved validation.
— - CVE-2020-9802
A logic issue was addressed with improved restrictions.
— - CVE-2020-29623
"Clear History and Website Data" did not clear the history.
— - CVE-2020-27918
A use after free issue was addressed with improved memory management.
— - CVE-2020-13753
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl.
— - CVE-2020-13584
An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64.
highCVSSv3 8.8 - CVE-2020-13558
A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1.
highCVSSv3 8.8 - CVE-2020-13543
A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0.
highCVSSv3 8.8 - CVE-2014-1745
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers t…
highCVSSv3 7.1