Bug 2270288 (CVE-2024-23252)

Summary:	CVE-2024-23252 webkit: processing malicious web content may lead to denial-of-service
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mcatanza
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in WebKit. This flaw allows an attacker to trigger a denial of service condition by convincing a victim to visit a specially crafted website.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2274440, 2274441
Bug Blocks:	2270297

Description TEJ RATHI 2024-03-19 12:47:14 UTC

Processing web content may lead to a denial-of-service. The issue was addressed with improved memory handling.
WebKit Bugzilla: 263758

Comment 2 TEJ RATHI 2024-04-11 05:24:47 UTC

Created webkitgtk tracking bugs for this issue:

Affects: fedora-all [bug 2274440]

Comment 3 TEJ RATHI 2024-04-11 05:29:01 UTC

Created webkit2gtk4.0 tracking bugs for this issue:

Affects: fedora-rawhide [bug 2274441]

Comment 4 Michael Catanzaro 2024-04-11 13:15:56 UTC

This CVE was created in error. Apple says the underlying bug is not a security issue. Seems like there was some miscommunication between the developer team and their Product Security.