CVE-2023-2203

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	WebKitGTK	Affects webkit2gtk3 v2.38.5-1.el8 and webkit2gtk3 v2.38.5-1.el9, Fixed in webkit2gtk3 v2.38.5-1.el8_8.3 and webkit2gtk3 v2.38.5-1.el9_2.1

References

https://access.redhat.com/errata/RHSA-2023:2653Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:3108Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-2203Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2188543Issue Tracking, Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:2653Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:3108Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-2203Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2188543Issue Tracking, Third Party Advisory

Timeline

Published: May 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-220314.4Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2023-220324.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 a CVE-2023-220334.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. D CVE-2023-220344.9Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 19.3-19.19 and 21.3-21.10 CVE-2023-220356.1Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected CVE-2023-220363.7Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility CVE-2023-220376.5Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: MS Excel Specific). Supporte CVE-2023-220382.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected a CVE-2023-220395.4Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: WebClient). The supported version that is affected is 9.3 CVE-2023-22047.5A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been declared as critical. Affected by this vulnerabi CVE-2023-220406.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2023-220415.1Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot