14078 matches found
webkitgtk: Processing web content may lead to arbitrary code execution
A vulnerability was found in WebKit. This flaw allows a remote attacker to perform arbitrary code execution when processing web content. This flaw is caused by insufficient memory handling, which attackers could exploit to execute malicious code on affected systems...
webkitgtk: use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports
A use-after-free vulnerability was found in the WebKitGTK's MediaRecorder API that may lead to memory corruption and Remote Code Execution. The victim needs to access a malicious web page to trigger this vulnerability...
The vulnerability of the WPE WebKit and WebKitGTK page rendering modules, related to the occurrence of operations outside the buffer in memory, allows attackers to cause service failures.
The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
[SECURITY] Fedora 42 Update: chromium-138.0.7204.49-1.fc42
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 41 Update: chromium-138.0.7204.49-1.fc41
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 41 Update: chromium-137.0.7151.119-1.fc41
Chromium is an open-source web browser, powered by WebKit Blink...
📄 Glass Cage Zero-Click iMessage Exploit Details
Glass Cage, a vulnerability chain discovered on iOS 18.2, enables an attacker to compromise a device silently by sending a single malicious PNG image via iMessage. The exploit bypasses multiple layers of Apple's defenses, including BlastDoor, WebKit sandboxing, and CoreMedia memory protections...
Astra Linux – Vulnerability in WebKit2GTK
A “use-after-free” issue has been addressed through improved memory management. This issue is fixed in Safari 18.4, iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari cras...
Astra Linux – Vulnerability in WebKit2GTK
This issue has been resolved through improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption...
[SECURITY] Fedora 41 Update: chromium-137.0.7151.103-1.fc41
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 42 Update: chromium-137.0.7151.103-1.fc42
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 42 Update: chromium-137.0.7151.55-1.fc42
Chromium is an open-source web browser, powered by WebKit Blink...
CLSA-2025-1748626479 webkit2gtk3: Fix of CVE-2025-24201
CVE-2025-24201: address issue with out-of-bounds write by adding improved checks...
CVE-2024-23226
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to arbitrary code execution...
CVE-2020-17534
There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in webkit subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows...
CVE-2012-3694
WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site...
CVE-2017-1000121
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products...
CVE-2013-1009
WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than CVE-2013-1023...