14079 matches found
webkit: processing maliciously crafted web content prevents Content Security Policy from being enforced
A flaw was found in WebKit. This flaw allows remote attackers to bypass security restrictions due to a logic flaw by persuading a victim to access a specially crafted website, enabling attackers to circumvent the Content Security Policy enforcement...
webkitgtk: Memory corruption may lead to arbitrary code execution
A memory corruption issue was found in webkitgtk that affected WebKitGTK versions before 2.28.3 and WPE WebKit versions before 2.28.3. This flaw allows an attacker to process maliciously crafted web content that may lead to arbitrary code execution. The highest threat from this vulnerability is t...
The vulnerability of the WPE WebKit and WebKitGTK page rendering modules, related to the occurrence of operations outside the buffer in memory, allows attackers to cause service failures.
The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
[SECURITY] Fedora 42 Update: chromium-138.0.7204.49-1.fc42
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 41 Update: chromium-138.0.7204.49-1.fc41
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 41 Update: chromium-137.0.7151.119-1.fc41
Chromium is an open-source web browser, powered by WebKit Blink...
📄 Glass Cage Zero-Click iMessage Exploit Details
Glass Cage, a vulnerability chain discovered on iOS 18.2, enables an attacker to compromise a device silently by sending a single malicious PNG image via iMessage. The exploit bypasses multiple layers of Apple's defenses, including BlastDoor, WebKit sandboxing, and CoreMedia memory protections...
Astra Linux – Vulnerability in WebKit2GTK
A “use-after-free” issue has been addressed through improved memory management. This issue is fixed in Safari 18.4, iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari cras...
Astra Linux – Vulnerability in WebKit2GTK
This issue has been resolved through improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption...
[SECURITY] Fedora 41 Update: chromium-137.0.7151.103-1.fc41
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 42 Update: chromium-137.0.7151.103-1.fc42
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 42 Update: chromium-137.0.7151.55-1.fc42
Chromium is an open-source web browser, powered by WebKit Blink...
CLSA-2025-1748626479 webkit2gtk3: Fix of CVE-2025-24201
CVE-2025-24201: address issue with out-of-bounds write by adding improved checks...
CVE-2024-23226
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to arbitrary code execution...
CVE-2020-17534
There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in webkit subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows...
CVE-2012-3694
WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site...
CVE-2017-1000121
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products...
CVE-2013-1009
WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than CVE-2013-1023...