Webkitgtk vulnerabilities, page 4
134 vulnerabilities
Known vulnerabilities in Webkitgtk products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
RoutineCVE-2019-8719apple · icloud for windows +12 moreapple icloud for windowsA logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to universal cross site scripting.CVSS6.1MediumEPSS1.25%RoutineCVE-2019-8764apple · watchos +7 moreapple watchosA logic issue was addressed with improved state management. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to universal cross site scripting.CVSS6.1MediumEPSS0.97%RoutineCVE-2019-8674apple · ios +9 moreapple iosA logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting.CVSS6.1MediumEPSS1.01%RoutineCVE-2019-8625apple · icloud for windows +12 moreapple icloud for windowsA logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to universal cross site scripting.CVSS6.1MediumEPSS1.22%RoutineCVE-2019-11070webkitgtk +7 morewebkitgtk webkitgtkWebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.CVSS5.3MediumEPSS3.29%RoutineCVE-2019-6234apple · icloud for windows +13 moreapple icloud for windowsA memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.CVSS8.8HighEPSS1.80%PrioritiseCVE-2019-8375canonical · ubuntu_linux +20 morecanonical ubuntu_linuxThe UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).CVSS9.8CriticalEPSS15.70%PrioritiseCVE-2019-6251canonical · ubuntu_linux +8 morecanonical ubuntu_linuxWebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.CVSS8.1HighEPSS4.26%RoutineCVE-2018-4213apple · icloud +12 moreapple icloudIn iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.CVSS8.8HighEPSS2.02%RoutineCVE-2018-4212apple · icloud +12 moreapple icloudIn iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.CVSS8.8HighEPSS2.06%RoutineCVE-2018-4210apple · iphone_os +11 moreapple iphone_osIn iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, an array indexing issue existed in the handling of a function in javascript core. This issue was addressed with improved checks.CVSS8.8HighEPSS2.25%RoutineCVE-2018-4208apple · icloud +12 moreapple icloudIn iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.CVSS8.8HighEPSS2.06%RoutineCVE-2018-4207apple · icloud +12 moreapple icloudIn iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.CVSS8.8HighEPSS2.04%PrioritiseCVE-2018-12911canonical · ubuntu_linux +7 morecanonical ubuntu_linuxWebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.CVSS9.8CriticalEPSS1.73%PrioritiseCVE-2018-12293canonical · ubuntu_linux +7 morecanonical ubuntu_linuxThe getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.3 and WPE WebKit prior to version 2.20.1, is vulnerable to a heap-based buffer overflow triggered by an integer overflow, which could be abused by crafted HTML content.CVSS8.8HighEPSS10.03%RoutineCVE-2018-11713gnome · libsoup +6 moregnome libsoupWebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.CVSS6.5MediumEPSS1.55%PrioritiseCVE-2018-11712webkitgtk +5 morewebkitgtk webkitgtkWebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed to perform TLS certificate verification for WebSocket connections.CVSS7.5HighEPSS1.16%PrioritiseCVE-2018-11646webkitgtk +5 morewebkitgtk webkitgtkwebkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.CVSS7.5HighEPSS68.02%RoutineCVE-2018-4165apple · icloud +11 moreapple icloudAn issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.CVSS8.8HighEPSS1.89%RoutineCVE-2018-4163apple · icloud +12 moreapple icloudAn issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.CVSS8.8HighEPSS2.01%