CVE-2019-8375
Critical · 9.8CVSS
9.8
EPSS
15.7%
Published
Feb 24, 2019
CISA due date
—
The record
The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | webkit2gtk | 0 | 2.24.1-1 |
| Debian:12 | webkit2gtk | 0 | 2.24.1-1 |
| Debian:13 | webkit2gtk | 0 | 2.24.1-1 |
| Debian:14 | webkit2gtk | 0 | 2.24.1-1 |
| SUSE:Linux Enterprise Desktop 12 SP3 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Desktop 12 SP4 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 | webkit2gtk3 | 0 | 2.24.0-3.21.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 | webkit2gtk3 | 0 | 2.24.0-3.21.1 |
| SUSE:Linux Enterprise Server 12 SP3 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Server 12 SP4 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP3 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP4 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Workstation Extension 12 SP3 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| SUSE:Linux Enterprise Workstation Extension 12 SP4 | webkit2gtk3 | 0 | 2.24.0-2.38.2 |
| Ubuntu:16.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:16.04:LTS | qtwebkit-source | 0 | No fix |
| Ubuntu:16.04:LTS | webkit2gtk | 0 | No fix |
| Ubuntu:16.04:LTS | webkitgtk | 0 | No fix |
| Ubuntu:18.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:18.04:LTS | qtwebkit-source | 0 | No fix |
| Ubuntu:18.04:LTS | webkit2gtk | 0 | 2.24.1-0ubuntu0.18.04.1 |
| Ubuntu:18.04:LTS | webkitgtk | 0 | No fix |
| Ubuntu:20.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | qtwebkit-source | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | webkit2gtk | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | webkitgtk | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | qtwebkit-source | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | webkitgtk | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:Pro:22.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| Ubuntu:Pro:24.04:LTS | qtwebkit-opensource-src | 0 | No fix |
| openSUSE:Leap 15.0 | webkit2gtk3 | 0 | 2.24.0-lp150.2.16.1 |
| openSUSE:Tumbleweed | gtk3 | 0 | 2.32.4-1.1 |
Related vulnerabilities
- CVE-2025-6558 Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to… Also affects webkit2gtk
- CVE-2025-24201 An out-of-bounds write issue was addressed with improved checks to prevent unauthorized… Also affects webkit2gtk
- CVE-2024-54534 The issue was addressed with improved memory handling. Also affects webkit2gtk
- CVE-2024-54508 The issue was addressed with improved memory handling. Also affects webkit2gtk
- CVE-2024-54505 A type confusion issue was addressed with improved memory handling. Also affects webkit2gtk
- CVE-2024-54502 The issue was addressed with improved checks. Also affects webkit2gtk
- CVE-2024-54479 The issue was addressed with improved checks. Also affects webkit2gtk
- CVE-2024-44308 The issue was addressed with improved checks. Also affects webkit2gtk