{
  "threat_severity" : "Moderate",
  "public_date" : "2023-12-01T00:00:00Z",
  "bugzilla" : {
    "description" : "webkitgtk: Out-of-bounds read leads to sensitive data leak",
    "id" : "2253054",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2253054"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-20->CWE-125",
  "details" : [ "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.", "A flaw was found in WebKitGTK. Processing malicious web content may cause an out-of-bounds read due to an improper input validation, resulting in sensitive content leaking." ],
  "statement" : "The WebKitGTK package versions, as shipped with Red Hat Enterprise 8 and 9, are not affected by this vulnerability. This flaw is related to the JIT code, which is currently disabled by default on both Red Hat Enterprise Linux versions.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2025-07-07T00:00:00Z",
    "advisory" : "RHSA-2025:10364",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "webkitgtk4-0:2.48.3-2.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-07-18T00:00:00Z",
    "advisory" : "RHSA-2023:4202",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "webkit2gtk3-0:2.38.5-1.el8_8.5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-07-18T00:00:00Z",
    "advisory" : "RHSA-2023:4201",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "webkit2gtk3-0:2.38.5-1.el9_2.3"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "webkitgtk",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "webkitgtk3",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-42916\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-42916\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog" ],
  "name" : "CVE-2023-42916",
  "csaw" : false
}