CVE-2019-6216

Multiple memory corruption issues were addressed with improved memory handling. This issue is...

8.8 HighFix available

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.84%Down 2.8 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2019-6216
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-6216
Updated: 2026-11-02

EUVDEUVD-2019-15783 No score

Record: EUVD-2019-15783
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j4hj-vrrc-fcp7 8.8

Multiple memory corruption issues were addressed with improved memory handling. This issue is...

Record: GHSA-j4hj-vrrc-fcp7
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVALPINE-CVE-2019-6216 8.8

Record: ALPINE-CVE-2019-6216
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV 8.8

Record: CVE-2019-6216
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVDEBIAN-CVE-2019-6216 8.8

Record: DEBIAN-CVE-2019-6216
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-6216 8.8

Record: UBUNTU-CVE-2019-6216
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2019:0308-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558):

Security vulnerabilities fixed:

CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553)
CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554)
CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555)
CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556)
CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557)
CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558)
CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

Other bug fixes and changes:

Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
Fix Web inspector magnifier under Wayland.
Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
Fix several crashes, race conditions, and rendering issues.

For a detailed list of changes, please refer to:

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2019:0308-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11506-1 No score

libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media

These are all security issues fixed in the libjavascriptcoregtk-4_0-18-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11506-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0497-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558):

Security vulnerabilities fixed:

CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553)
CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554)
CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555)
CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556)
CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557)
CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558)
CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

Other bug fixes and changes:

Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
Fix Web inspector magnifier under Wayland.
Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
Fix several crashes, race conditions, and rendering issues.

For a detailed list of changes, please refer to:

Record: SUSE-SU-2019:0497-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0511-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues:

Security issues fixed:

CVE-2019-6212: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6215: Fixed a type confusion vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6216: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6217: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6226: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6227: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6229: Fixed a logic issue by improving validation which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6233: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6234: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.

Other issues addressed:

Update to version 2.22.6 (bsc#1124937).
Kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
Fixed Web inspector magnifier under Wayland.
Fixed garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
Fixed several crashes, race conditions, and rendering issues.

Record: SUSE-SU-2019:0511-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`webkit2gtk` Alpine:v3.10	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.11	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.12	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.13	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.14	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.15	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.16	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.17	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.18	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.19	before 2.22.7-r0	2.22.7-r0

Show 35 moreShow less

Affected packages
Package	Affected	Fixed
`webkit2gtk` Alpine:v3.20	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.9	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Debian:12	before 2.22.5-1	2.22.5-1
`webkit2gtk` Debian:13	before 2.22.5-1	2.22.5-1
`webkit2gtk` Debian:14	before 2.22.5-1	2.22.5-1
`webkit2gtk3` SUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 15 CVEs	before 2.22.6-3.18.2	2.22.6-3.18.2
`webkit2gtk3` SUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 15 CVEs	before 2.22.6-3.18.2	2.22.6-3.18.2
`webkit2gtk3` SUSE:OpenStack Cloud 7 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Workstation Extension 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Enterprise Storage 4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`qtwebkit-opensource-src` Ubuntu:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1	None known
`webkit2gtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less 2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1	None known
`qtwebkit-source` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11	None known
`webkitgtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1	None known
`webkit2gtk` Ubuntu:18.04:LTS	before 2.22.5-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 13 moreShow less 2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.1	2.22.5-0ubuntu0.18.04.1
`qtwebkit-opensource-src` Ubuntu:18.04:LTS	All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1	None known
`qtwebkit-source` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu13	None known
`webkitgtk` Ubuntu:18.04:LTS	All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3	None known
`qtwebkit-opensource-src` Ubuntu:20.04:LTS	All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1	None known
`qtwebkit-opensource-src` Ubuntu:22.04:LTS	All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1	None known
`qtwebkit-opensource-src` Ubuntu:24.04:LTS	All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36	None known
`webkit2gtk3` openSUSE:Leap 15.0 From an advisory covering 15 CVEs	before 2.22.6-lp150.2.12.1	2.22.6-lp150.2.12.1
`gtk3` openSUSE:Tumbleweed From an advisory covering 126 CVEs	before 2.32.4-1.1	2.32.4-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-6216 is a high vulnerability (CVSS 8.8) in Apple Icloud, published February 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in webkit2gtk 2.22.7-r0.

References

Show 154 moreShow less