CVEvulnerability
CVE-2019-6251
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-01-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Description
WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.
Affected configurations
• gnome epiphany (<= 3.31.4)
• webkitgtk webkitgtk (< 2.24.1)
• wpewebkit wpe webkit (< 2.24.1)
• fedoraproject fedora 28
• fedoraproject fedora 29
• fedoraproject fedora 30
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
• opensuse leap 15.0
• opensuse leap 42.3
References
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html Third Party Advisory
- http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Code-Execution.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/04/11/1 Mailing List, Third Party Advisory
- https://bugs.webkit.org/show_bug.cgi?id=194208 Issue Tracking, Vendor Advisory
- https://gitlab.gnome.org/GNOME/epiphany/issues/532 Exploit, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSCDI3635E37GL4BNJDRDT2KEUBDLGSO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LACVFU4MYYRPJ3IEA4UCN5KUEAGCCJ72/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPI3R6QWDJBA5KNGA6QSMKYLY5RRHBZ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UO3DIA54X7FOUWFZW5YXC2MZ6KNHG6SW/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Apr/21 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201909-05 security.gentoo.org
- https://trac.webkit.org/changeset/243434 Patch, Vendor Advisory
- https://usn.ubuntu.com/3948-1/ Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html Third Party Advisory
- http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Code-Execution.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/04/11/1 Mailing List, Third Party Advisory
- https://bugs.webkit.org/show_bug.cgi?id=194208 Issue Tracking, Vendor Advisory
- https://gitlab.gnome.org/GNOME/epiphany/issues/532 Exploit, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSCDI3635E37GL4BNJDRDT2KEUBDLGSO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LACVFU4MYYRPJ3IEA4UCN5KUEAGCCJ72/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPI3R6QWDJBA5KNGA6QSMKYLY5RRHBZ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UO3DIA54X7FOUWFZW5YXC2MZ6KNHG6SW/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Apr/21 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201909-05 security.gentoo.org
- https://trac.webkit.org/changeset/243434 Patch, Vendor Advisory
- https://usn.ubuntu.com/3948-1/ Third Party Advisory