Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2019-8609: WebKitGTK can run attacker code via crafted web page
CVE-2019-8609 · published 6 years ago
Summary
The WebKitGTK component used on Debian can mishandle memory when it reads specially crafted web content, which could let an attacker run any program on the affected machine. This creates a risk of the system being taken over. Install the latest security update for WebKitGTK to apply the fix.
What to do
- Update debian webkit2gtk to version 2.24.1-1.
- Update apple icloud to version 7.12 or later.
- Update apple itunes to version 12.9.5 or later.
- Update apple safari to version 12.1.1 or later.
- Update apple iphone_os to version 12.3 or later.
- Update apple mac_os_x to version 10.14.5 or later.
- Update apple tvos to version 12.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | webkit2gtk |
< 2.24.1-1 Fix: upgrade to 2.24.1-1
|
| Debian:13 | debian | webkit2gtk |
< 2.24.1-1 Fix: upgrade to 2.24.1-1
|
| Debian:14 | debian | webkit2gtk |
< 2.24.1-1 Fix: upgrade to 2.24.1-1
|
| – | apple | icloud |
< 7.12 cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* |
| – | apple | itunes |
< 12.9.5 cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* |
| – | apple | safari |
< 12.1.1 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | iphone_os |
< 12.3 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | apple | mac_os_x |
< 10.14.5 cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
| – | apple | tvos |
< 12.3 cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
Original advisory text
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud fo...
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.
References
- https://security-tracker.debian.org/tracker/CVE-2019-8609 Vendor Advisory
- https://support.apple.com/HT210118 Vendor Advisory
- https://support.apple.com/HT210119 Vendor Advisory
- https://support.apple.com/HT210120 Vendor Advisory
- https://support.apple.com/HT210123 Vendor Advisory
- https://support.apple.com/HT210124 Vendor Advisory
- https://support.apple.com/HT210125 Vendor Advisory
- https://support.apple.com/HT210212 Vendor Advisory
Severity
8.8
High
Type
CWE-787Out-of-bounds Write
Timeline
Published18 Dec 2019
Updated4 Nov 2026
First seen21 Sep 2026
Track software like this
Free during beta