Spoofing attack in WebKitGTK+ and WPE WebKit - CVE-2022-32891

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU67197

Spoofing attack in WebKitGTK+ and WPE WebKit - CVE-2022-32891

Published: September 12, 2022 / Updated: September 19, 2022


Vulnerability identifier: #VU67197
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-32891
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of frames on the webpage within WebKit. A remote attacker can spoof page content.


Affected software

WebKitGTK+
WPE WebKit
Gentoo Linux
Anolis OS
Fedora
watchOS
Apple iOS
iPadOS
tvOS
Migration Toolkit for Virtualization
Apple Safari
webkit2gtk3
net-libs/webkit-gtk
webkit2gtk3-devel
webkit2gtk3-jsc
webkit2gtk3-jsc-devel
webkitgtk4 (Red Hat package)

How to mitigate CVE-2022-32891

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

WebKitGTK+ - update to 2.36.5
WPE WebKit - update to 2.36.5
Migration Toolkit for Virtualization - update to 2.4.3
Apple Safari - update to 16.0
webkit2gtk3 - addressed in versions 2.38.0-2.fc35, 2.38.0-2.fc36
net-libs/webkit-gtk - update to 2.40.1
webkit2gtk3 - update to 2.42.5-1.0.1
webkit2gtk3-devel - update to 2.42.5-1.0.1
webkit2gtk3-jsc - update to 2.42.5-1.0.1
webkit2gtk3-jsc-devel - update to 2.42.5-1.0.1
webkitgtk4 (Red Hat package) - update to 2.48.3-2.el7_9
watchOS - update to 9.0 20R361
Apple iOS - update to 16.0 20A362
iPadOS - update to 16.0 20A362
tvOS - update to 16.0 20J373

External References

Related Security Bulletins