WebKitGTK Memory Corruption Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-23

[ Description ]Official description

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

CISA: WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Jun 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• bugzilla.redhat.com/show_bug.cgiIssue TrackingThird Party Advisory
• webkitgtk.org/security/WSA-2019-0005.htmlVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource