SB2023091164 - Multiple vulnerabilities in WebKitGTK+ and WPE WebKit

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Security features bypass (CVE-ID: CVE-2023-32370)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error in WebKit, as Content Security Policy may fail to block domains with wildcards. A remote attacker can bypass implemented CSP restrictions.

2) Use-after-free (CVE-ID: CVE-2023-28198)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim to open a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Remediation

Install update from vendor's website.

References

• https://support.apple.com/en-us/HT213670
• https://webkitgtk.org/security/WSA-2023-0008.html