The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service (release assertion) of the UI process. This vulnerability does not affect Apple products.
CVSS Details
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade webkit2gtk | Jul 30, 2024 | Nov 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade webkitgtk3 | Dec 4, 2017 | Nov 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade webkitgtk3 | Dec 4, 2017 | Nov 1, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Nov 1, 2017 |
| Suse | — | Upgrade typelib-1_0-webkit2-4_0Upgrade typelib-1_0-javascriptcore-4_0Upgrade libwebkit2gtk3-langUpgrade libjavascriptcoregtk-4_0-18Upgrade webkit2gtk-4_0-injected-bundlesUpgrade typelib-1_0-webkit2webextension-4_0Upgrade webkit2gtk3-develUpgrade libwebkit2gtk-4_0-37 | Nov 21, 2018 | Nov 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub