CVE-2023-28205

wpewebkit: A use after free issue was addressed with improved memory management

CVE-2023-28205 is fixed in 17 products on 1 platform, first by DEBIAN-CVE-2023-28205, released April 10, 2023. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on April 10, 2023. Patch Radar priority: Patch now.

Patch nowCISA KEV

CVSS

8.8

high

Exploitation

Exploited

Listed by CISA

CISA KEV

Apr 10, 2023

Federal due date May 1, 2023

EPSS

0.2708

98th percentile

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Where it's fixed

Product	Fixed in	Fix	Released
Linux
gir1.2-javascriptcoregtk-4.0 · Ubuntu 20.04 LTS (focal)	2.38.6-0ubuntu0.20.04.1	gir1.2-javascriptcoregtk-4.0 2.38.6-0ubuntu0.20.04.1	Apr 23, 2023
gir1.2-javascriptcoregtk-4.0 · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	gir1.2-javascriptcoregtk-4.0 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
gir1.2-javascriptcoregtk-4.1 · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	gir1.2-javascriptcoregtk-4.1 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
gir1.2-webkit2-4.0 · Ubuntu 20.04 LTS (focal)	2.38.6-0ubuntu0.20.04.1	gir1.2-webkit2-4.0 2.38.6-0ubuntu0.20.04.1	Apr 23, 2023
gir1.2-webkit2-4.0 · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	gir1.2-webkit2-4.0 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
gir1.2-webkit2-4.1 · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	gir1.2-webkit2-4.1 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
libjavascriptcoregtk-4.0-18 · Ubuntu 20.04 LTS (focal)	2.38.6-0ubuntu0.20.04.1	libjavascriptcoregtk-4.0-18 2.38.6-0ubuntu0.20.04.1	Apr 23, 2023
libjavascriptcoregtk-4.0-18 · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	libjavascriptcoregtk-4.0-18 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
libjavascriptcoregtk-4.0-bin · Ubuntu 20.04 LTS (focal)	2.38.6-0ubuntu0.20.04.1	libjavascriptcoregtk-4.0-bin 2.38.6-0ubuntu0.20.04.1	Apr 23, 2023
libjavascriptcoregtk-4.0-bin · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	libjavascriptcoregtk-4.0-bin 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
libjavascriptcoregtk-4.1-0 · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	libjavascriptcoregtk-4.1-0 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
libwebkit2gtk-4.0-37 · Ubuntu 20.04 LTS (focal)	2.38.6-0ubuntu0.20.04.1	libwebkit2gtk-4.0-37 2.38.6-0ubuntu0.20.04.1	Apr 23, 2023
libwebkit2gtk-4.0-37 · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	libwebkit2gtk-4.0-37 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
libwebkit2gtk-4.0-37-gtk2 · Ubuntu 20.04 LTS (focal)	2.38.6-0ubuntu0.20.04.1	libwebkit2gtk-4.0-37-gtk2 2.38.6-0ubuntu0.20.04.1	Apr 23, 2023
libwebkit2gtk-4.1-0 · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	libwebkit2gtk-4.1-0 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
webkit2gtk · Debian 12.15 (bookworm)	2.40.1-1	DEBIAN-CVE-2023-28205	Apr 10, 2023
webkit2gtk · Debian 13.5 (trixie)	2.40.1-1	DEBIAN-CVE-2023-28205	Apr 10, 2023
webkit2gtk · Debian 14	2.40.1-1	DEBIAN-CVE-2023-28205	Apr 10, 2023
webkit2gtk-driver · Ubuntu 20.04 LTS (focal)	2.38.6-0ubuntu0.20.04.1	webkit2gtk-driver 2.38.6-0ubuntu0.20.04.1	Apr 23, 2023
webkit2gtk-driver · Ubuntu 22.04.1 LTS (jammy)	2.38.6-0ubuntu0.22.04.1	webkit2gtk-driver 2.38.6-0ubuntu0.22.04.1	Apr 23, 2023
webkit2gtk3 · RHEL 8	0:2.36.7-1.el8_7.3	RHSA-2023:1919	Apr 20, 2023
webkit2gtk3 · RHEL 9	0:2.36.7-1.el9_1.3	RHSA-2023:1918	Apr 20, 2023
webkit2gtk3 · almalinux 8	2.38.5-1.el8_8.3	ALSA-2023:3108	May 16, 2023
webkit2gtk3 · almalinux 9	2.38.5-1.el9_2.1	ALSA-2023:2653	May 9, 2023
webkit2gtk3 · ol 8	0:2.36.7-1.el8_7.3	ELSA-2023-1919	Apr 20, 2023
webkit2gtk3 · ol 9	0:2.36.7-1.el9_1.3	ELSA-2023-1918	Apr 20, 2023
webkit2gtk3 · rocky 8	0:2.36.7-1.el8_7.3	RLSA-2023:1919	Apr 26, 2023
webkit2gtk3 · rocky 9	0:2.36.7-1.el9_1.3	RLSA-2023:1918	Apr 26, 2023
webkit2gtk3-devel · RHEL 8	0:2.36.7-1.el8_7.3	RHSA-2023:1919	Apr 20, 2023
webkit2gtk3-devel · RHEL 9	0:2.36.7-1.el9_1.3	RHSA-2023:1918	Apr 20, 2023
webkit2gtk3-devel · almalinux 8	2.38.5-1.el8_8.3	ALSA-2023:3108	May 16, 2023
webkit2gtk3-devel · almalinux 9	2.38.5-1.el9_2.1	ALSA-2023:2653	May 9, 2023
webkit2gtk3-devel · ol 8	0:2.36.7-1.el8_7.3	ELSA-2023-1919	Apr 20, 2023
webkit2gtk3-devel · ol 9	0:2.36.7-1.el9_1.3	ELSA-2023-1918	Apr 20, 2023
webkit2gtk3-jsc · RHEL 8	0:2.36.7-1.el8_7.3	RHSA-2023:1919	Apr 20, 2023
webkit2gtk3-jsc · RHEL 9	0:2.36.7-1.el9_1.3	RHSA-2023:1918	Apr 20, 2023
webkit2gtk3-jsc · almalinux 8	2.38.5-1.el8_8.3	ALSA-2023:3108	May 16, 2023
webkit2gtk3-jsc · almalinux 9	2.38.5-1.el9_2.1	ALSA-2023:2653	May 9, 2023
webkit2gtk3-jsc · ol 8	0:2.36.7-1.el8_7.3	ELSA-2023-1919	Apr 20, 2023
webkit2gtk3-jsc · ol 9	0:2.36.7-1.el9_1.3	ELSA-2023-1918	Apr 20, 2023
webkit2gtk3-jsc-devel · RHEL 8	0:2.36.7-1.el8_7.3	RHSA-2023:1919	Apr 20, 2023
webkit2gtk3-jsc-devel · RHEL 9	0:2.36.7-1.el9_1.3	RHSA-2023:1918	Apr 20, 2023
webkit2gtk3-jsc-devel · almalinux 8	2.38.5-1.el8_8.3	ALSA-2023:3108	May 16, 2023
webkit2gtk3-jsc-devel · almalinux 9	2.38.5-1.el9_2.1	ALSA-2023:2653	May 9, 2023
webkit2gtk3-jsc-devel · ol 8	0:2.36.7-1.el8_7.3	ELSA-2023-1919	Apr 20, 2023
webkit2gtk3-jsc-devel · ol 9	0:2.36.7-1.el9_1.3	ELSA-2023-1918	Apr 20, 2023
wpewebkit · Debian 12.15 (bookworm)	2.38.6-1	DEBIAN-CVE-2023-28205	Apr 10, 2023
wpewebkit · Debian 13.5 (trixie)	2.38.6-1	DEBIAN-CVE-2023-28205	Apr 10, 2023
wpewebkit · Debian 14	2.38.6-1	DEBIAN-CVE-2023-28205	Apr 10, 2023

Details

Published
April 10, 2023
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA required action
Apply updates per vendor instructions.

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/cve/CVE-2023-28205">CVE-2023-28205 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Is this on your machines?

Patchblox finds every install below the fixed version on Windows, macOS and Linux, and updates them through your release rings.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.