Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2016-7589: Debian WebKitGTK may run code or crash from malicious site
CVE-2016-7589 · published 9 years ago
Summary
The WebKitGTK component used in Debian can be tricked by a specially crafted web page to execute unwanted code or cause the program to stop working. This could let an attacker take control of the affected application or disrupt service. Install the latest Debian updates for WebKitGTK or apply the provided security patch as soon as possible.
What to do
- Update debian webkit2gtk to version 2.14.3-1.
- Update canonical webkit2gtk to version 2.14.3-0ubuntu0.16.04.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | webkit2gtk |
< 2.14.3-1 Fix: upgrade to 2.14.3-1
|
| Debian:13 | debian | webkit2gtk |
< 2.14.3-1 Fix: upgrade to 2.14.3-1
|
| Debian:14 | debian | webkit2gtk |
< 2.14.3-1 Fix: upgrade to 2.14.3-1
|
| – | apple | iphone_os |
<= 10.1.1 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | apple | safari |
<= 10.0.1 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | icloud |
<= 6.0.1 cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:* |
| – | apple | itunes |
<= 12.5.3 cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:* |
| – | apple | watchos |
<= 2.2.2 cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | webkit2gtk |
< 2.14.3-0ubuntu0.16.04.1 Fix: upgrade to 2.14.3-0ubuntu0.16.04.1
|
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
Original advisory text
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. watchOS before 3.1...
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. watchOS before 3.1.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
References
- https://ubuntu.com/security/CVE-2016-7589 Third Party Advisory
- https://support.apple.com/en-us/HT207421 Third Party Advisory
- https://webkitgtk.org/security/WSA-2017-0001.html Third Party Advisory
- https://ubuntu.com/security/notices/USN-3191-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2016-7589 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2016-7589 Vendor Advisory
- http://www.securityfocus.com/bid/94908 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1037459
- https://security.gentoo.org/glsa/201706-15
- https://support.apple.com/HT207421 Vendor Advisory
- https://support.apple.com/HT207422 Vendor Advisory
- https://support.apple.com/HT207424 Vendor Advisory
- https://support.apple.com/HT207427 Vendor Advisory
- https://support.apple.com/HT207487 Vendor Advisory
Severity
8.8
High
Type
CWE-119Buffer Overflow
Timeline
Published31 Dec 2016
Updated3 Nov 2026
First seen22 Sep 2026
Track software like this
Free during beta