CVE Database›CVE-2022-48503

CVE-2022-48503

webkitgtk: improper bounds checking leading to arbitrary code execution

Loading…

Severity

Important

Red Hat Product Security

8.8

CVSS 3.1

Review impact separately from score.

Published · June 29, 2023

Updated · November 1, 2026

Description

A vulnerability was found in webkitgtk. This issue occurs when processing web content, which may lead to arbitrary code execution.

Statement

WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality..

WebKitGTK4 is used in Red Hat Enterprise Linux 7 by the following packages: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

To mitigate this vulnerability, consider removing certain GNOME packages. Note that uninstalling these packages will break functionality in GNOME, however the server can still be used via the terminal interface.

CVSS / CWE

CVSS 3.1 · 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-94 · Improper Control of Generation of Code