Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
archlinuxArchLinuxASA-201909-1
HistorySep 04, 2019 - 12:00 a.m.

[ASA-201909-1] webkit2gtk: multiple issues

2019-09-0400:00:00
security.archlinux.org
19

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.291 Low

EPSS

Percentile

96.8%

JSON

Arch Linux Security Advisory ASA-201909-1

Severity: Critical
Date : 2019-09-04
CVE-ID : CVE-2019-8644 CVE-2019-8649 CVE-2019-8658 CVE-2019-8669
CVE-2019-8678 CVE-2019-8680 CVE-2019-8683 CVE-2019-8684
CVE-2019-8688
Package : webkit2gtk
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1033

Summary

The package webkit2gtk before version 2.24.4-1 is vulnerable to
multiple issues including arbitrary code execution and cross-site
scripting.

Resolution

Upgrade to 2.24.4-1.

pacman -Syu “webkit2gtk>=2.24.4-1”

The problems have been fixed upstream in version 2.24.4.

Workaround

None.

Description

  • CVE-2019-8644 (arbitrary code execution)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to arbitrary code execution.

  • CVE-2019-8649 (cross-site scripting)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to universal cross site
scripting.

  • CVE-2019-8658 (cross-site scripting)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to universal cross site
scripting.

  • CVE-2019-8669 (arbitrary code execution)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to arbitrary code execution.

  • CVE-2019-8678 (arbitrary code execution)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to arbitrary code execution.

  • CVE-2019-8680 (arbitrary code execution)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to arbitrary code execution.

  • CVE-2019-8683 (arbitrary code execution)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to arbitrary code execution.

  • CVE-2019-8684 (arbitrary code execution)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to arbitrary code execution.

  • CVE-2019-8688 (arbitrary code execution)

An issue has been found in WebKitGTK before 2.24.4 where processing
maliciously crafted web content may lead to arbitrary code execution.

Impact

A remote attacker can bypass security restrictions via universal cross-
site scripting or execute arbitrary code via crafted web content.

References

https://webkitgtk.org/security/WSA-2019-0004.html
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8644
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8649
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8658
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8669
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8678
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8680
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8683
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8684
https://webkitgtk.org/security/WSA-2019-0004.html#CVE-2019-8688
https://security.archlinux.org/CVE-2019-8644
https://security.archlinux.org/CVE-2019-8649
https://security.archlinux.org/CVE-2019-8658
https://security.archlinux.org/CVE-2019-8669
https://security.archlinux.org/CVE-2019-8678
https://security.archlinux.org/CVE-2019-8680
https://security.archlinux.org/CVE-2019-8683
https://security.archlinux.org/CVE-2019-8684
https://security.archlinux.org/CVE-2019-8688

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanywebkit2gtk< 2.24.4-1UNKNOWN

References

Related

ubuntu 1
nessus 27
openvas 17
freebsd 1
debian 1
mageia 1
apple 16
kaspersky 2
suse 4
osv 1
redhatcve 9
debiancve 9
checkpoint_advisories 1
prion 9
veracode 9
cve 9
alpinelinux 9
packetstorm 1
ubuntucve 9
zdi 3
zdt 1
gentoo 1
amazon 1
oraclelinux 1
centos 1
redhat 1
kitploit 1
ubuntu
ubuntu
WebKitGTK+ vulnerabilities
2019-09-11 00:00:00
nessus
nessus
Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-4130-1)
2019-09-12 00:00:00
Debian DSA-4515-1 : webkit2gtk - security update
2019-09-05 00:00:00
FreeBSD : webkit2-gtk3 -- Multiple vulnerabilities (e45c3669-caf2-11e9-851a-dcf3aaa3f3ff)
2019-09-03 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-4130-1)
2019-09-12 00:00:00
Mageia: Security Advisory (MGASA-2019-0281)
2022-01-28 00:00:00
Apple iCloud Security Update (HT210357) - Windows
2019-07-24 00:00:00
freebsd
freebsd
webkit2-gtk3 -- Multiple vulnerabilities
2019-08-29 00:00:00
debian
debian
[SECURITY] [DSA 4515-1] webkit2gtk security update
2019-09-04 20:55:05
mageia
mageia
Updated webkit2 packages fix security vulnerabilities
2019-09-15 17:45:31
apple
apple
About the security content of iTunes 12.9.6 for Windows
2019-07-23 00:00:00
About the security content of iCloud for Windows 10.6
2019-07-23 00:00:00
About the security content of iCloud for Windows 7.13
2019-07-23 00:00:00
kaspersky
kaspersky
KLA11527 Multiple vulnerabilities in Apple iCloud
2019-07-25 00:00:00
KLA11526 Multiple vulnerabilities in Apple iTunes
2019-07-23 00:00:00
suse
suse
Security update for webkit2gtk3 (important)
2019-09-28 00:00:00
Security update for webkit2gtk3 (important)
2019-09-28 00:00:00
Security update for webkit2gtk3 (important)
2019-11-30 00:00:00
osv
osv
webkit2gtk - security update
2019-09-04 00:00:00
redhatcve
redhatcve
CVE-2019-8680
2020-09-07 19:48:53
CVE-2019-8644
2020-09-07 18:19:03
CVE-2019-8678
2020-09-07 19:48:47
debiancve
debiancve
CVE-2019-8680
2019-12-18 18:15:00
CVE-2019-8658
2019-12-18 18:15:00
CVE-2019-8684
2019-12-18 18:15:00
checkpoint_advisories
checkpoint_advisories
Apple Multiple Products Memory Corruption (CVE-2019-8684)
2020-07-03 00:00:00
prion
prion
Memory corruption
2019-12-18 18:15:00
Memory corruption
2019-12-18 18:15:00
Memory corruption
2019-12-18 18:15:00
veracode
veracode
Cross-Site Scripting (XSS)
2020-09-10 01:24:01
Arbitrary Code Execution
2020-09-10 01:24:02
Arbitrary Code Execution
2020-09-10 01:24:02
cve
cve
CVE-2019-8658
2019-12-18 18:15:00
CVE-2019-8684
2019-12-18 18:15:00
CVE-2019-8644
2019-12-18 18:15:00
alpinelinux
alpinelinux
CVE-2019-8678
2019-12-18 18:15:00
CVE-2019-8658
2019-12-18 18:15:00
CVE-2019-8684
2019-12-18 18:15:00
packetstorm
packetstorm
JSC BytecodeGenerator::emitEqualityOpImpl Data Mishandling
2019-07-30 00:00:00
ubuntucve
ubuntucve
CVE-2019-8684
2019-09-04 00:00:00
CVE-2019-8680
2019-09-04 00:00:00
CVE-2019-8644
2019-09-04 00:00:00
zdi
zdi
Apple Safari operationPutByValOptimize Out-Of-Bounds Read Information Disclosure Vulnerability
2019-07-24 00:00:00
Apple Safari CSSFontFace Use-After-Free Remote Code Execution Vulnerability
2019-07-24 00:00:00
Apple Safari bind Type Confusion Remote Code Execution Vulnerability
2019-07-24 00:00:00
zdt
zdt
WebKit - Universal Cross-Site Scripting due to Synchronous Page Loads Exploit
2019-07-25 00:00:00
gentoo
gentoo
WebkitGTK+: Multiple vulnerabilities
2019-09-06 00:00:00
amazon
amazon
Medium: webkitgtk4
2020-11-09 21:05:00
oraclelinux
oraclelinux
webkitgtk4 security, bug fix, and enhancement update
2020-10-06 00:00:00
centos
centos
webkitgtk4 security update
2020-10-20 19:07:36
redhat
redhat
(RHSA-2020:4035) Moderate: webkitgtk4 security, bug fix, and enhancement update
2020-09-29 07:53:27
kitploit
kitploit
Fuzzilli - A JavaScript Engine Fuzzer
2020-11-21 20:30:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.291 Low

EPSS

Percentile

96.8%

JSON
Related for ASA-201909-1
ubuntu1nessus27openvas17freebsd1debian1mageia1apple16kaspersky2suse4osv1redhatcve9debiancve9checkpoint_advisories1prion9veracode9cve9alpinelinux9packetstorm1ubuntucve9zdi3zdt1gentoo1amazon1oraclelinux1centos1redhat1kitploit1