PT-2019-4962 · Apple+7 · Webkitgtk+8

Dhiraj · Published 2018-09-11 · Updated 2024-06-15 · CVE-2019-6251

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebKitGTK and WPE WebKit versions prior to 2.24.1

Description The issue is related to insufficient input validation in WebKitGTK and WPE WebKit, allowing an attacker to conduct spoofing attacks. This can cause malicious web content to be displayed as if it were from a trusted URI, potentially deceiving users. The attack can be initiated remotely and involves certain JavaScript redirections.

Recommendations For WebKitGTK and WPE WebKit versions prior to 2.24.1, update to version 2.24.1 or later to resolve the issue. As a temporary workaround, consider restricting JavaScript redirections in the browser settings until the update is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2019:3553

ALT-PU-2019-1458

ALT-PU-2019-1637

BDU:2020-01582

CESA-2019_3553

CESA-2020_4035

CVE-2019-6251

OPENSUSE-SU-2019:1374-1

OPENSUSE-SU-2019_1374-1

OPENSUSE-SU-2019_1391-1

OPENSUSE-SU-2024:11506-1

RHSA-2019:3553

RHSA-2019_3553

RHSA-2020:4035

RHSA-2020_4035

RLSA-2019:3553

SUSE-SU-2019:1137-1

SUSE-SU-2019:1155-1

USN-3948-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Rocky Linux

Suse

Ubuntu

Wpe Webkit

Webkitgtk

References · 647

• 🔥 https://github.com/BadAccess11/CVE-2019-8601 · Exploit
• 🔥 https://gitlab.gnome.org/GNOME/epiphany/issues/532 · Exploit
• https://ubuntu.com/security/CVE-2019-8518 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01577 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8611 · Security Note
• https://bdu.fstec.ru/vul/2022-07045 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8524 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-6251 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05677 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6251 · Security Note
• https://bdu.fstec.ru/vul/2020-01109 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8844 · Security Note
• https://bdu.fstec.ru/vul/2020-01690 · Security Note
• https://security.gentoo.org/glsa/201909-05 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6251 · Vendor Advisory