CVE-2022-48503
webkitgtk: improper bounds checking leading to arbitrary code execution
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 29, 2023
Updated · November 1, 2026
Description
A vulnerability was found in webkitgtk. This issue occurs when processing web content, which may lead to arbitrary code execution.
Statement
WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality..
WebKitGTK4 is used in Red Hat Enterprise Linux 7 by the following packages: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
To mitigate this vulnerability, consider removing certain GNOME packages. Note that uninstalling these packages will break functionality in GNOME, however the server can still be used via the terminal interface.
CVSS / CWE
CVSS 3.1 · 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-94 · Improper Control of Generation of Code