Ubuntu update for webkit2gtk
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-23529 |
| CWE-ID | CWE-843 |
| Exploitation vector | Network |
| Public exploit | This vulnerability is being exploited in the wild. |
| Vulnerable software |
Ubuntu Operating systems & Components / Operating system libjavascriptcoregtk-4.1-0 (Ubuntu package) Other libwebkit2gtk-4.1-0 (Ubuntu package) Other libjavascriptcoregtk-4.0-18 (Ubuntu package) Operating systems & Components / Operating system package or component libjavascriptcoregtk-5.0-0 (Ubuntu package) Operating systems & Components / Operating system package or component libwebkit2gtk-4.0-37 (Ubuntu package) Operating systems & Components / Operating system package or component libwebkit2gtk-5.0-0 (Ubuntu package) Operating systems & Components / Operating system package or component |
| Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains one critical risk vulnerability.
1) Type Confusion
EUVDB-ID: #VU72161
Risk: Critical
CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]
CVE-ID: CVE-2023-23529
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error when parsing web content in WebKit. A remote attacker can trick the victim to visit a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.
Note, the vulnerability is being actively exploited in the wild.
Update the affected package webkit2gtk to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 22.10
libjavascriptcoregtk-4.1-0 (Ubuntu package): before 2.38.5-0ubuntu0.22.04.1
libwebkit2gtk-4.1-0 (Ubuntu package): before 2.38.5-0ubuntu0.22.04.1
libjavascriptcoregtk-4.0-18 (Ubuntu package): before 2.38.5-0ubuntu0.20.04.1
libjavascriptcoregtk-5.0-0 (Ubuntu package): before 2.38.5-0ubuntu0.22.10.1
libwebkit2gtk-4.0-37 (Ubuntu package): before 2.38.5-0ubuntu0.20.04.1
libwebkit2gtk-5.0-0 (Ubuntu package): before 2.38.5-0ubuntu0.22.10.1
CPE2.3- cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:22.10:*:*:*:*:*:*:*
- cpe:2.3::canonical:libjavascriptcoregtk-4.1-0_ubuntu_package:*:*:*:*:*:*:*:*
- cpe:2.3::canonical:libwebkit2gtk-4.1-0_ubuntu_package:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:libjavascriptcoregtk-4.0-18_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:libjavascriptcoregtk-5.0-0_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:libwebkit2gtk-4.0-37_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:libwebkit2gtk-5.0-0_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5893-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
