Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2024-40782: Debian WebKitGTK can crash from malicious web pages
CVE-2024-40782 · published 2 years ago
Summary
The WebKitGTK components used in Debian (webkit2gtk, wpewebkit, qtwebkit-source, webkitgtk, qtwebkit-opensource-src) may crash if they process specially crafted web content. This could cause the affected application to stop working unexpectedly. Install the latest security updates for these packages to prevent the crash.
What to do
- Update debian webkit2gtk to version 2.44.3-1~deb11u1.
- Update debian webkit2gtk to version 2.44.3-1~deb12u1.
- Update debian webkit2gtk to version 2.44.3-1.
- Update debian wpewebkit to version 2.44.3-1.
- Update canonical webkit2gtk to version 2.44.3-0ubuntu0.22.04.1.
- Update canonical webkit2gtk to version 2.44.3-0ubuntu0.24.04.1.
- Update apple safari to version 17.6 or later.
- Update apple macos to version 14.6 or later.
- Update apple tvos to version 17.6 or later.
- Update apple visionos to version 1.3 or later.
- Update apple watchos to version 10.6 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | webkit2gtk |
< 2.44.3-1~deb11u1 Fix: upgrade to 2.44.3-1~deb11u1
|
| Debian:12 | debian | webkit2gtk |
< 2.44.3-1~deb12u1 Fix: upgrade to 2.44.3-1~deb12u1
|
| Debian:13 | debian | webkit2gtk |
< 2.44.3-1 Fix: upgrade to 2.44.3-1
|
| Debian:14 | debian | webkit2gtk |
< 2.44.3-1 Fix: upgrade to 2.44.3-1
|
| Debian:11 | debian | wpewebkit | All versions |
| Debian:12 | debian | wpewebkit | All versions |
| Debian:13 | debian | wpewebkit |
< 2.44.3-1 Fix: upgrade to 2.44.3-1
|
| Debian:14 | debian | wpewebkit |
< 2.44.3-1 Fix: upgrade to 2.44.3-1
|
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:18.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:20.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:20.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:20.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:22.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:22.04:LTS | canonical | webkit2gtk |
< 2.44.3-0ubuntu0.22.04.1 Fix: upgrade to 2.44.3-0ubuntu0.22.04.1
|
| Ubuntu:22.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:24.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:24.04:LTS | canonical | webkit2gtk |
< 2.44.3-0ubuntu0.24.04.1 Fix: upgrade to 2.44.3-0ubuntu0.24.04.1
|
| – | apple | safari |
< 17.6 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | ipados |
< 16.7.9 >= 17.0, < 17.6 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| – | apple | iphone_os |
< 16.7.9 >= 17.0, < 17.6 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | apple | macos |
>= 14.0, < 14.6 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| – | apple | tvos |
< 17.6 cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
| – | apple | visionos |
< 1.3 cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* |
| – | apple | watchos |
< 10.6 cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
Original advisory text
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visio...
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.
References
- https://security-tracker.debian.org/tracker/CVE-2024-40782 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-40782 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-40782 Third Party Advisory
- https://ubuntu.com/security/notices/USN-6996-1 Vendor Advisory
- https://webkitgtk.org/security/WSA-2024-0004.html Third Party Advisory
- https://support.apple.com/en-us/120908
- https://support.apple.com/en-us/120909
- https://support.apple.com/en-us/120911
- https://support.apple.com/en-us/120913
- https://support.apple.com/en-us/120914
- https://support.apple.com/en-us/120915
- https://support.apple.com/en-us/120916
- http://seclists.org/fulldisclosure/2024/Jul/15 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/16 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/17 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/21 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/22 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/23 Mailing List
- https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html
- https://support.apple.com/en-us/HT214116 Vendor Advisory
- https://support.apple.com/en-us/HT214117 Vendor Advisory
- https://support.apple.com/en-us/HT214119 Vendor Advisory
- https://support.apple.com/en-us/HT214121 Vendor Advisory
- https://support.apple.com/en-us/HT214122 Vendor Advisory
- https://support.apple.com/en-us/HT214123 Vendor Advisory
- https://support.apple.com/en-us/HT214124 Vendor Advisory
- https://support.apple.com/kb/HT214116
- https://support.apple.com/kb/HT214117
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214122
- https://support.apple.com/kb/HT214123
- https://support.apple.com/kb/HT214124
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-416Use After Free
Timeline
Published29 Jul 2024
Updated4 Nov 2026
First seen3 Apr 2026
Track software like this
Free during beta