CVE-2019-6251
Published: 14 January 2019
WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
webkit2gtk Launchpad, Ubuntu, Debian |
upstream |
Released
(2.24.1)
|
| trusty |
Does not exist
|
|
| bionic |
Released
(2.24.1-0ubuntu0.18.04.1)
|
|
| cosmic |
Released
(2.24.1-0ubuntu0.18.10.2)
|
|
| disco |
Not vulnerable
(2.24.1-1)
|
|
| eoan |
Not vulnerable
(2.24.1-1)
|
|
| focal |
Not vulnerable
(2.24.1-1)
|
|
| impish |
Not vulnerable
(2.24.1-1)
|
|
| groovy |
Not vulnerable
(2.24.1-1)
|
|
| hirsute |
Not vulnerable
(2.24.1-1)
|
|
| xenial |
Deferred
|
|
| jammy |
Not vulnerable
(2.24.1-1)
|
|
| kinetic |
Not vulnerable
(2.24.1-1)
|
|
| lunar |
Not vulnerable
(2.24.1-1)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.1 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |