HighFix available
webkit2gtk, wpewebkit — security advisory
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.
- Products
- webkit2gtk, wpewebkit
- Affected versions
- Not specified
- Fixed versions
- 2.36.0-1, 2.36.0-2
- CVEs
- CVE-2022-22629
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:35 UTC · Revision 1
Source evidence
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.
osv:DEBIAN-CVE-2022-22629
webkit2gtk
Fixed versions: 2.36.0-1
webkit2gtk
Fixed versions: 2.36.0-1
webkit2gtk
Fixed versions: 2.36.0-1
wpewebkit
Fixed versions: 2.36.0-2
wpewebkit
Fixed versions: 2.36.0-2
wpewebkit
Fixed versions: 2.36.0-2
Complete source record
{
"id": "88d9b0b836c825d170c23692e53b1c1a8f847cd501c9051a49167a71398dcd37",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-22629",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-22629",
"summary": "A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.",
"evidence": "osv:DEBIAN-CVE-2022-22629",
"products": [
{
"name": {
"value": "webkit2gtk",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.36.0-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "webkit2gtk",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.36.0-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "webkit2gtk",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.36.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wpewebkit",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.36.0-2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wpewebkit",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.36.0-2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wpewebkit",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.36.0-2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2022-22629",
"aliases": [
"DEBIAN-CVE-2022-22629"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.36.0-1"
}
]
}
],
"package": {
"name": "webkit2gtk",
"purl": "pkg:deb/debian/webkit2gtk?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-22629.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.36.0-1"
}
]
}
],
"package": {
"name": "webkit2gtk",
"purl": "pkg:deb/debian/webkit2gtk?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-22629.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.36.0-1"
}
]
}
],
"package": {
"name": "webkit2gtk",
"purl": "pkg:deb/debian/webkit2gtk?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-22629.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.36.0-2"
}
]
}
],
"package": {
"name": "wpewebkit",
"purl": "pkg:deb/debian/wpewebkit?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-22629.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.36.0-2"
}
]
}
],
"package": {
"name": "wpewebkit",
"purl": "pkg:deb/debian/wpewebkit?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-22629.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.36.0-2"
}
]
}
],
"package": {
"name": "wpewebkit",
"purl": "pkg:deb/debian/wpewebkit?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-22629.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:00:50.852046531Z",
"provider": "osv",
"upstream": [
"CVE-2022-22629"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-22629"
]
},
"related_cves": [
{
"value": "CVE-2022-22629",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 322677,
"published_at": "2022-09-23T20:15:09.307+00:00"
}