Fedora 30 update for webkit2gtk3



| Updated: 2025-04-24
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2019-6251
CVE-2019-11070
CWE-ID CWE-451
CWE-19
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

webkit2gtk3
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Spoofing attack

EUVDB-ID: #VU17739

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-6251

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform spoofing attack.

The weakness exists due to improper parsing of specific HTTP content. A remote attacker can trick the victim to follow a specially crafted link and perform a spoofing attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

webkit2gtk3: before 2.24.1-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-d9a15be3ba


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Data Handling

EUVDB-ID: #VU31117

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-11070

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

webkit2gtk3: before 2.24.1-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-d9a15be3ba


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###