Linux · Security advisory · July 18, 2023

RHSA-2023:4202: Security update for 4 packages

RHSA-2023:4202, released July 18, 2023, fixes 16 CVEs across 4 products. 6 of them are being exploited (CVE-2023-41993); 6 on CISA KEV. Patch Radar priority: Patch now.

Patch now6 on CISA KEV

CVEs closed

1 rated Critical

Exploited

CVE-2023-41993

Exploitation more likely

Vendor assessment

Highest EPSS

0.2435

97th percentile

Priority of the 16 CVEs

Patch now 6
                                Urgent 1
                                High 8
                                Routine 1

Fixed package versions

Product	Release	Fixed in
webkit2gtk3	RHEL 8	0:2.38.5-1.el8_8.5
webkit2gtk3-devel	RHEL 8	0:2.38.5-1.el8_8.5
webkit2gtk3-jsc	RHEL 8	0:2.38.5-1.el8_8.5
webkit2gtk3-jsc-devel	RHEL 8	0:2.38.5-1.el8_8.5

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2023-41993	webkit2gtk: The issue was addressed with improved checks	9.8	0.2435	KEVExploited
Patch now	CVE-2023-32439	webkit2gtk: A type confusion issue was addressed with improved checks	8.8	0.2397	KEVExploited
Patch now	CVE-2023-32435	webkit2gtk: A memory corruption issue was addressed with improved state management	8.8	0.2295	KEVExploited
Patch now	CVE-2023-37450	webkit2gtk: The issue was addressed with improved checks	8.8	0.1895	KEVExploited
Patch now	CVE-2023-42916	webkit2gtk: An out-of-bounds read was addressed with improved input validation	6.8	0.1782	KEVExploited
Patch now	CVE-2024-23222	Unknown	8.8	0.1059	KEVExploited
Urgent	CVE-2025-24264	WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash	9.8	0.0094	None reported
High	CVE-2023-41074	webkit2gtk: The issue was addressed with improved checks	8.8	0.0412	None reported
High	CVE-2023-35074	webkit2gtk: The issue was addressed with improved memory handling	8.8	0.0158	None reported
High	CVE-2024-27808	WebKit: Processing web content may lead to arbitrary code execution	8.8	0.0118	None reported
High	CVE-2025-31206	WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash	8.8	0.0100	None reported
High	CVE-2024-27833	gir1.2-javascriptcoregtk-4.0: An integer overflow was addressed with improved input validation	8.8	0.0082	None reported
High	CVE-2025-31204	WebKit: Processing maliciously crafted web content may lead to memory corruption	8.8	0.0068	None reported
High	CVE-2025-24223	gir1.2-javascriptcoregtk-4.1: The issue was addressed with improved memory handling	8.8	0.0033	None reported
High	CVE-2024-23252	webkit2gtk3: This update for webkit2gtk3 fixes the following issues: - Update to version 2.44.2 (bsc#1225071): - CVE-2024-23252:...	n/a	n/a	None reported
Routine	CVE-2025-31215	WebKit: Processing maliciously crafted web content may lead to an unexpected process crash	6.5	0.0065	None reported

Also fixes CVE-2023-41993

RHSA-2023:4201
webkit2gtk3, webkit2gtk3-devel, webkit2gtk3-jsc and 1 more on RHEL 9
gir1.2-javascriptcoregtk-4.0 2.42.1-0ubuntu0.22.04.1
gir1.2-javascriptcoregtk-4.0 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-javascriptcoregtk-4.1 2.42.1-0ubuntu0.22.04.1
gir1.2-javascriptcoregtk-4.1 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-javascriptcoregtk-6.0 2.42.1-0ubuntu0.22.04.1
gir1.2-javascriptcoregtk-6.0 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-webkit-6.0 2.42.1-0ubuntu0.22.04.1
gir1.2-webkit-6.0 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-webkit2-4.0 2.42.1-0ubuntu0.22.04.1
gir1.2-webkit2-4.0 on Ubuntu 22.04.1 LTS (jammy)
gir1.2-webkit2-4.1 2.42.1-0ubuntu0.22.04.1
gir1.2-webkit2-4.1 on Ubuntu 22.04.1 LTS (jammy)
libjavascriptcoregtk-4.0-18 2.42.1-0ubuntu0.22.04.1
libjavascriptcoregtk-4.0-18 on Ubuntu 22.04.1 LTS (jammy)

Vendor advisory

https://access.redhat.com/errata/RHSA-2023:4202

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo