CVE-2024-40866

EUVD-2024-38699
The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 25%
Affected Products (NVD)
VendorProductVersion
applesafari
𝑥
< 18.0
applemacos
𝑥
< 15.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
webkit2gtk
bookworm
2.48.5-1~deb12u1
ignored
bookworm (security)
2.50.4-1~deb12u1
fixed
bullseye
ignored
bullseye (security)
2.50.4-1~deb11u1
fixed
forky
2.50.4-1
fixed
sid
2.50.4-1
fixed
trixie
2.50.1-1~deb13u1
fixed
trixie (security)
2.50.4-1~deb13u1
fixed
wpewebkit
bookworm
ignored
bullseye
ignored
bullseye (security)
vulnerable
forky
2.50.4-1
fixed
sid
2.50.4-1
fixed
trixie
2.48.3-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
webkitgtk
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
xenial
ignored
webkit2gtk
bionic
ignored
focal
ignored
jammy
Fixed 2.46.1-0ubuntu0.22.04.3
released
noble
Fixed 2.46.1-0ubuntu0.24.04.1
released
oracular
Fixed 2.46.1-0ubuntu1
released
xenial
ignored
qtwebkit-source
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
xenial
ignored
qtwebkit-opensource-src
bionic
ignored
focal
ignored
jammy
ignored
noble
ignored
oracular
ignored
xenial
ignored
wpewebkit
focal
ignored
jammy
ignored
noble
dne
oracular
dne
References
https://support.apple.com/en-us/121238
https://support.apple.com/en-us/121241
http://seclists.org/fulldisclosure/2024/Sep/33
http://seclists.org/fulldisclosure/2024/Sep/37
https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html