CVE-2019-8375
24.02.2019, 13:29
The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).Enginsight
| Vendor | Product | Version |
|---|---|---|
| webkitgtk | webkitgtk | 𝑥 ≤ 2.23.90 |
| webkitgtk | webkitgtk\+ | 𝑥 ≤ 2.22.6 |
| opensuse | leap | 15.0 |
| opensuse | leap | 42.3 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 18.10 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| qtwebkit |
| ||||||||||||||||||||||||||||||
| qtwebkit-opensource-src |
| ||||||||||||||||||||||||||||||
| qtwebkit-source |
| ||||||||||||||||||||||||||||||
| webkit2gtk |
| ||||||||||||||||||||||||||||||
| webkitgtk |
|
Common Weakness Enumeration
References