The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade webkit2gtk | Jul 30, 2024 | Nov 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade webkitgtk3 | Dec 4, 2017 | Nov 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade webkitgtk3 | Dec 4, 2017 | Nov 1, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Nov 1, 2017 |
| Suse | — | Upgrade typelib-1_0-webkit2-4_0Upgrade webkit2gtk3-develUpgrade webkit2gtk-4_0-injected-bundlesUpgrade libwebkit2gtk-4_0-37Upgrade typelib-1_0-javascriptcore-4_0Upgrade typelib-1_0-webkit2webextension-4_0Upgrade libjavascriptcoregtk-4_0-18Upgrade libwebkit2gtk3-lang | Nov 21, 2018 | Nov 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub