Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-40779: WebKit GTK components may crash from crafted web content
CVE-2024-40779 · published 2 years ago
Summary
The WebKitGTK and related packages used on Debian and Ubuntu systems can read data outside of its intended memory area when processing specially crafted web pages, which can cause the application to crash. This does not expose data, but it can disrupt services that rely on these components. Upgrade to the latest package versions that include the fix, or apply the vendor’s security update as soon as possible.
What to do
- Update debian webkit2gtk to version 2.44.3-1~deb11u1.
- Update debian webkit2gtk to version 2.44.3-1~deb12u1.
- Update debian webkit2gtk to version 2.44.3-1.
- Update debian wpewebkit to version 2.44.3-1.
- Update canonical webkit2gtk to version 2.44.3-0ubuntu0.24.04.1.
- Update canonical webkit2gtk to version 2.44.3-0ubuntu0.22.04.1.
- Update apple safari to version 17.6 or later.
- Update apple watchos to version 10.6 or later.
- Update apple tvos to version 17.6 or later.
- Update apple visionos to version 1.3 or later.
- Update apple macos to version 14.6 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | webkit2gtk |
< 2.44.3-1~deb11u1 Fix: upgrade to 2.44.3-1~deb11u1
|
| Debian:12 | debian | webkit2gtk |
< 2.44.3-1~deb12u1 Fix: upgrade to 2.44.3-1~deb12u1
|
| Debian:13 | debian | webkit2gtk |
< 2.44.3-1 Fix: upgrade to 2.44.3-1
|
| Debian:14 | debian | webkit2gtk |
< 2.44.3-1 Fix: upgrade to 2.44.3-1
|
| Debian:11 | debian | wpewebkit | All versions |
| Debian:12 | debian | wpewebkit | All versions |
| Debian:13 | debian | wpewebkit |
< 2.44.3-1 Fix: upgrade to 2.44.3-1
|
| Debian:14 | debian | wpewebkit |
< 2.44.3-1 Fix: upgrade to 2.44.3-1
|
| Ubuntu:24.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:24.04:LTS | canonical | webkit2gtk |
< 2.44.3-0ubuntu0.24.04.1 Fix: upgrade to 2.44.3-0ubuntu0.24.04.1
|
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:18.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:20.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:20.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:20.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:22.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:22.04:LTS | canonical | webkit2gtk |
< 2.44.3-0ubuntu0.22.04.1 Fix: upgrade to 2.44.3-0ubuntu0.22.04.1
|
| Ubuntu:22.04:LTS | canonical | wpewebkit | All versions |
| – | apple | iphone_os |
< 16.7.9 >= 17.0, < 17.6 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | apple | ipados |
< 16.7.9 >= 17.0, < 17.6 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| – | apple | safari |
< 17.6 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | watchos |
< 10.6 cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
| – | apple | tvos |
< 17.6 cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
| – | apple | visionos |
< 1.3 cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* |
| – | apple | macos |
< 14.6 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
Original advisory text
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS...
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.
References
- https://security-tracker.debian.org/tracker/CVE-2024-40779 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-40779 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-40779 Third Party Advisory
- https://webkitgtk.org/security/WSA-2024-0004.html Third Party Advisory
- https://support.apple.com/en-us/120908
- https://support.apple.com/en-us/120909
- https://support.apple.com/en-us/120911
- https://support.apple.com/en-us/120913
- https://support.apple.com/en-us/120914
- https://support.apple.com/en-us/120915
- https://support.apple.com/en-us/120916
- http://seclists.org/fulldisclosure/2024/Jul/15 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/16 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/17 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/21 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/22 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/23 Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html
- https://support.apple.com/en-us/HT214116 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214117 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214119 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214121 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214122 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214123 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214124 Release Notes Vendor Advisory
- https://support.apple.com/kb/HT214116
- https://support.apple.com/kb/HT214117
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214122
- https://support.apple.com/kb/HT214123
- https://support.apple.com/kb/HT214124
- https://ubuntu.com/security/notices/USN-6996-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-125Out-of-bounds Read
Timeline
Published29 Jul 2024
Updated4 Nov 2026
First seen3 Apr 2026
Track software like this
Free during beta