Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-8733: webkit2gtk may run malicious code from crafted web pages

CVE-2019-8733 · published 6 years ago

Summary

The WebKitGTK library on Debian can mishandle specially crafted web content, allowing an attacker to run any code on the affected system. This could let a hacker take control of the computer or steal data. Install the latest Debian updates that include the WebKitGTK security fix, or apply any patches the vendor provides as soon as possible.

What to do

Update debian webkit2gtk to version 2.24.4-1.
Update apple itunes to version 12.10.1 or later.
Update apple tvos to version 13 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	webkit2gtk	< 2.24.4-1 Fix: upgrade to 2.24.4-1
Debian:13	debian	webkit2gtk	< 2.24.4-1 Fix: upgrade to 2.24.4-1
Debian:14	debian	webkit2gtk	< 2.24.4-1 Fix: upgrade to 2.24.4-1
–	apple	icloud	< 7.14 >= 10.0, < 10.7 `cpe:2.3:a:apple:icloud::::::windows::*`
–	apple	itunes	< 12.10.1 `cpe:2.3:a:apple:itunes::::::windows::*`
–	apple	tvos	< 13 `cpe:2.3:o:apple:tvos::::::::`

Original advisory text

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Process...

References

https://security-tracker.debian.org/tracker/CVE-2019-8733 Vendor Advisory
https://security.gentoo.org/glsa/202003-22 Third Party Advisory
https://support.apple.com/HT210635 Vendor Advisory
https://support.apple.com/HT210636 Vendor Advisory
https://support.apple.com/HT210637 Vendor Advisory

Severity

8.8 High

Exploitation

2% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published18 Dec 2019

Updated3 Nov 2026

First seen21 Sep 2026

Sources

DEBIAN-CVE-2019-8733 · OSV

CVE-2019-8733 · NVD

Track software like this

Free during beta