CVE-2022-22589
Published: 11 February 2022
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript.
Priority
Medium
CVSS 3 base score: 6.1
Status
| Package | Release | Status |
|---|---|---|
|
qtwebkit-opensource-src Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Needs triage
|
|
|
qtwebkit-source Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
webkit Launchpad, Ubuntu, Debian |
upstream |
Needs triage
|
|
webkit2gtk Launchpad, Ubuntu, Debian |
bionic |
Deferred
|
| focal |
Released
(2.34.6-0ubuntu0.20.04.1)
|
|
| impish |
Released
(2.34.6-0ubuntu0.21.10.1)
|
|
| jammy |
Released
(2.35.3-1ubuntu1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(2.34.5,2.35.3)
|
|
| xenial |
Deferred
|
|
|
webkitgtk Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
wpewebkit Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Needs triage
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
Notes
| Author | Note |
|---|---|
| jdstrand | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8 |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22589
- https://webkitgtk.org/security/WSA-2022-0002.html
- https://ubuntu.com/security/notices/USN-5306-1
- NVD
- Launchpad
- Debian