CVE-2019-6251
High
Description
WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Webkitgtk
PublishedJan 14, 2019
First seenJan 14, 2019
How to fix
Update
- webkitgtk webkitgtk2.24.1 or later
- wpewebkit wpe_webkit2.24.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPI3R6QWDJBA5KNGA6QSMKYLY5RRHBZ/
- usn.ubuntu.com/3948-1/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LACVFU4MYYRPJ3IEA4UCN5KUEAGCCJ72/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UO3DIA54X7FOUWFZW5YXC2MZ6KNHG6SW/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSCDI3635E37GL4BNJDRDT2KEUBDLGSO/
- security.gentoo.org/glsa/201909-05
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webkitgtk webkitgtk | v < 2.24.1 | 2.24.1 |
| gnome epiphany | v ≤ 3.31.4 | — |
| wpewebkit wpe_webkit | v < 2.24.1 | 2.24.1 |
| fedoraproject fedora | 28, 29, 30 | — |
| canonical ubuntu_linux | 18.04, 18.10 | — |
| opensuse leap | 15.0, 42.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.