Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-6251

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.

Published

2019-01-14T08:29:00.223

Last Modified

2024-11-21T04:46:18.887

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

4.9

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	gnome	epiphany	≤ 3.31.4	Yes
Application	webkitgtk	webkitgtk	< 2.24.1	Yes
Application	wpewebkit	wpe_webkit	< 2.24.1	Yes
Operating System	fedoraproject	fedora	28	Yes
Operating System	fedoraproject	fedora	29	Yes
Operating System	fedoraproject	fedora	30	Yes
Operating System	canonical	ubuntu_linux	18.04	Yes
Operating System	canonical	ubuntu_linux	18.10	Yes
Operating System	opensuse	leap	15.0	Yes
Operating System	opensuse	leap	42.3	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Code-Execution.html Third Party Advisory, VDB Entry ([email protected])
http://www.openwall.com/lists/oss-security/2019/04/11/1 Mailing List, Third Party Advisory ([email protected])
https://bugs.webkit.org/show_bug.cgi?id=194208 Issue Tracking, Vendor Advisory ([email protected])
https://gitlab.gnome.org/GNOME/epiphany/issues/532 Exploit, Patch, Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSCDI3635E37GL4BNJDRDT2KEUBDLGSO/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LACVFU4MYYRPJ3IEA4UCN5KUEAGCCJ72/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPI3R6QWDJBA5KNGA6QSMKYLY5RRHBZ/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UO3DIA54X7FOUWFZW5YXC2MZ6KNHG6SW/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ/ ([email protected])
https://seclists.org/bugtraq/2019/Apr/21 Mailing List, Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/201909-05 ([email protected])
https://trac.webkit.org/changeset/243434 Patch, Vendor Advisory ([email protected])
https://usn.ubuntu.com/3948-1/ Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Code-Execution.html Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2019/04/11/1 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.webkit.org/show_bug.cgi?id=194208 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://gitlab.gnome.org/GNOME/epiphany/issues/532 Exploit, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSCDI3635E37GL4BNJDRDT2KEUBDLGSO/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LACVFU4MYYRPJ3IEA4UCN5KUEAGCCJ72/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPI3R6QWDJBA5KNGA6QSMKYLY5RRHBZ/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UO3DIA54X7FOUWFZW5YXC2MZ6KNHG6SW/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ/ (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Apr/21 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/201909-05 (af854a3a-2127-422b-91ae-364da2661108)
https://trac.webkit.org/changeset/243434 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/3948-1/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)