Home

CVE-2018-12293

Description

The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.3 and WPE WebKit prior to version 2.20.1, is vulnerable to a heap-based buffer overflow triggered by an integer overflow, which could be abused by crafted HTML content.

Risk Information

Base Score
8.8
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
38.999

Associated Vulnerability

VulnerabilityOS Platform
Web content engine library for GTK+ (USN-3481-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.16.04.1_amd64.debLinux
Web content engine library for GTK+ (USN-3481-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.16.04.1_i386.debLinux
Web content engine library for GTK+ (USN-3481-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.17.10.1_i386.debLinux
Web content engine library for GTK+ (USN-3481-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.16.04.1_amd64.debLinux
Web content engine library for GTK+ (USN-3481-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.16.04.1_i386.debLinux
Web content engine library for GTK+ (USN-3481-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.17.10.1_i386.debLinux
Web content engine library for GTK+ (USN-3635-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.17.10.1_i386.debLinux
Web content engine library for GTK+ (USN-3635-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.17.10.1_i386.debLinux
Web content engine library for GTK+ (USN-3640-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.17.10.1_i386.debLinux
Web content engine library for GTK+ (USN-3640-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.17.10.1_i386.debLinux
Web content engine library for GTK+ (USN-3687-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.17.10.1_i386.debLinux
Web content engine library for GTK+ (USN-3687-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.17.10.1_amd64.debLinux
Web content engine library for GTK+ (USN-3687-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.18.04.1_i386.debLinux
Web content engine library for GTK+ (USN-3687-1) libwebkit2gtk-4.0-37_2.20.3-0ubuntu0.18.04.1_amd64.debLinux
Web content engine library for GTK+ (USN-3687-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.17.10.1_i386.debLinux
Web content engine library for GTK+ (USN-3687-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.17.10.1_amd64.debLinux
Web content engine library for GTK+ (USN-3687-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.18.04.1_i386.debLinux
Web content engine library for GTK+ (USN-3687-1) libjavascriptcoregtk-4.0-18_2.20.3-0ubuntu0.18.04.1_amd64.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234