CVE-2024-40866

The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
appleCNA
---
---
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
VendorProductVersion
applesafari
𝑥
< 18.0
applemacos
𝑥
< 15.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
webkit2gtk
bullseye
ignored
bookworm
2.48.5-1~deb12u1
ignored
bullseye (security)
2.50.2-1~deb11u1
fixed
bookworm (security)
2.50.2-1~deb12u1
fixed
trixie
2.50.1-1~deb13u1
fixed
trixie (security)
2.50.2-1~deb13u1
fixed
forky
2.50.2-1
fixed
sid
2.50.3-1
fixed
wpewebkit
bullseye (security)
vulnerable
bullseye
ignored
bookworm
ignored
trixie
2.48.3-1
fixed
forky
2.50.2-1
fixed
sid
2.50.3-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
webkitgtk
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
webkit2gtk
oracular
Fixed 2.46.1-0ubuntu1
released
noble
Fixed 2.46.1-0ubuntu0.24.04.1
released
jammy
Fixed 2.46.1-0ubuntu0.22.04.3
released
focal
ignored
bionic
ignored
xenial
ignored
qtwebkit-source
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
qtwebkit-opensource-src
oracular
ignored
noble
ignored
jammy
ignored
focal
ignored
bionic
ignored
xenial
ignored
wpewebkit
oracular
dne
noble
dne
jammy
ignored
focal
ignored
References
https://support.apple.com/en-us/121238
https://support.apple.com/en-us/121241
http://seclists.org/fulldisclosure/2024/Sep/33
http://seclists.org/fulldisclosure/2024/Sep/37
https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html