CVE-2019-6251

high-risk

Published 2019-01-14

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.

Do I need to act?

2.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / LOW complexity

Affected Products (10)

Epiphany

Webkitgtk

Wpe Webkit

Fedora

Ubuntu Linux

Leap

Affected Vendors

Gnome Canonical Fedoraproject Opensuse Webkitgtk Wpewebkit

References (30)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html

Third Party Advisory http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Co...

Mailing List http://www.openwall.com/lists/oss-security/2019/04/11/1

Issue Tracking https://bugs.webkit.org/show_bug.cgi?id=194208

Exploit https://gitlab.gnome.org/GNOME/epiphany/issues/532

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Mailing List https://seclists.org/bugtraq/2019/Apr/21

https://security.gentoo.org/glsa/201909-05

Patch https://trac.webkit.org/changeset/243434

Third Party Advisory https://usn.ubuntu.com/3948-1/

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html

Third Party Advisory http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Co...

Mailing List http://www.openwall.com/lists/oss-security/2019/04/11/1

Issue Tracking https://bugs.webkit.org/show_bug.cgi?id=194208

and 10 more references

/ 100

high-risk

Severity 28/34 · Critical

Exploitability 6/34 · Minimal

Exposure 16/34 · Moderate