CVE-2024-23222

A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution due to a type confusion issue. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog.

This flaw depends on the WebKitGTK JIT engine to be enabled. This feature has been disabled in Red Hat Enterprise Linux 8.8 and 9.2 by the errata RHSA-2023:4202 and RHSA-2023:4201. Therefore, Red Hat Enterprise Linux 8.8 and 9.2, when these errata are applied, and newer versions are not affected by this vulnerability.

RHSA-2023:4202: https://access.redhat.com/errata/RHSA-2023:4202 RHSA-2023:4201: https://access.redhat.com/errata/RHSA-2023:4201

To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content. For this reason, this flaw was rated with an important, and not critical, severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process or load untrusted web content. Please update the affected package as soon as possible.