PT-2019-4959 · Apple+7 · Wpe Webkit+8

Michael Catanzaro · Published 2019-01-23 · Updated 2020-10-20 · CVE-2019-11070

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WebKitGTK and WPE WebKit versions prior to 2.24.1

Description The issue is related to the incorrect handling of data when loading video in real-time, which can allow a remote attacker to gain unauthorized access to protected information. This is due to the failure to properly apply configured HTTP proxy settings when downloading livestream video, resulting in deanonymization.

Recommendations For versions prior to 2.24.1, update to version 2.24.1 or later to resolve the issue. As a temporary workaround, consider restricting access to livestream video downloads until the update is applied.

Fix

Weakness Enumeration

CWE-19

Related Identifiers

ALSA-2019:3553

ALT-PU-2019-1637

BDU:2020-01579

CESA-2019_3553

CESA-2020_4035

CVE-2019-11070

OPENSUSE-SU-2019:1374-1

OPENSUSE-SU-2019_1374-1

OPENSUSE-SU-2019_1391-1

RHSA-2019:3553

RHSA-2019_3553

RHSA-2020:4035

RHSA-2020_4035

RLSA-2019:3553

SUSE-SU-2019:1137-1

SUSE-SU-2019:1155-1

SUSE-SU-2019_1155-1

USN-3948-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Rocky Linux

Suse

Ubuntu

Wpe Webkit

Webkitgtk

References · 175

• https://osv.dev/vulnerability/ALSA-2019:3553 · Vendor Advisory
• https://usn.ubuntu.com/3948-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6251 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8524 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8563 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8559 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2019-3553.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2019:3553 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8544 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8536 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01579 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:1155-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8535 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ · Vendor Advisory