CVE-2019-6229

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12...

6.1 MediumFix available

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.09%Down 1.8 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

Record: CVE-2019-6229
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-6229
Updated: 2026-11-02

EUVDEUVD-2019-15796 No score

Record: EUVD-2019-15796
Updated: 2026-11-03

GitHub AdvisoriesGHSA-phg3-r8vw-5qjw 6.1

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12...

Record: GHSA-phg3-r8vw-5qjw
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVALPINE-CVE-2019-6229 6.1

Record: ALPINE-CVE-2019-6229
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

OSV 6.1

Record: CVE-2019-6229
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Show 6 moreShow less

OSVDEBIAN-CVE-2019-6229 6.1

Record: DEBIAN-CVE-2019-6229
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-6229 6.1

Record: UBUNTU-CVE-2019-6229
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2019:0308-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558):

Security vulnerabilities fixed:

CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553)
CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554)
CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555)
CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556)
CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557)
CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558)
CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

Other bug fixes and changes:

Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
Fix Web inspector magnifier under Wayland.
Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
Fix several crashes, race conditions, and rendering issues.

For a detailed list of changes, please refer to:

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2019:0308-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11506-1 No score

libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media

These are all security issues fixed in the libjavascriptcoregtk-4_0-18-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11506-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0497-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558):

Security vulnerabilities fixed:

CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553)
CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554)
CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555)
CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556)
CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557)
CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558)
CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

Other bug fixes and changes:

Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
Fix Web inspector magnifier under Wayland.
Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
Fix several crashes, race conditions, and rendering issues.

For a detailed list of changes, please refer to:

Record: SUSE-SU-2019:0497-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0511-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues:

Security issues fixed:

CVE-2019-6212: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6215: Fixed a type confusion vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6216: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6217: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6226: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6227: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6229: Fixed a logic issue by improving validation which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6233: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
CVE-2019-6234: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.

Other issues addressed:

Update to version 2.22.6 (bsc#1124937).
Kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
Fixed Web inspector magnifier under Wayland.
Fixed garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
Fixed several crashes, race conditions, and rendering issues.

Record: SUSE-SU-2019:0511-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`webkit2gtk` Alpine:v3.10	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.11	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.12	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.13	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.14	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.15	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.16	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.17	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.18	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.19	before 2.22.7-r0	2.22.7-r0

Show 35 moreShow less

Affected packages
Package	Affected	Fixed
`webkit2gtk` Alpine:v3.20	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.9	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Debian:12	before 2.22.5-1	2.22.5-1
`webkit2gtk` Debian:13	before 2.22.5-1	2.22.5-1
`webkit2gtk` Debian:14	before 2.22.5-1	2.22.5-1
`webkit2gtk3` SUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 15 CVEs	before 2.22.6-3.18.2	2.22.6-3.18.2
`webkit2gtk3` SUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 15 CVEs	before 2.22.6-3.18.2	2.22.6-3.18.2
`webkit2gtk3` SUSE:OpenStack Cloud 7 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Linux Enterprise Workstation Extension 12 SP4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`webkit2gtk3` SUSE:Enterprise Storage 4 From an advisory covering 9 CVEs	before 2.22.6-2.35.1	2.22.6-2.35.1
`qtwebkit-opensource-src` Ubuntu:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1	None known
`webkit2gtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less 2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1	None known
`qtwebkit-source` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11	None known
`webkitgtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1	None known
`webkit2gtk` Ubuntu:18.04:LTS	before 2.22.5-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 13 moreShow less 2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.1	2.22.5-0ubuntu0.18.04.1
`qtwebkit-opensource-src` Ubuntu:18.04:LTS	All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1	None known
`qtwebkit-source` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu13	None known
`webkitgtk` Ubuntu:18.04:LTS	All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3	None known
`qtwebkit-opensource-src` Ubuntu:20.04:LTS	All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1	None known
`qtwebkit-opensource-src` Ubuntu:22.04:LTS	All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1	None known
`qtwebkit-opensource-src` Ubuntu:24.04:LTS	All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36	None known
`webkit2gtk3` openSUSE:Leap 15.0 From an advisory covering 15 CVEs	before 2.22.6-lp150.2.12.1	2.22.6-lp150.2.12.1
`gtk3` openSUSE:Tumbleweed From an advisory covering 126 CVEs	before 2.32.4-1.1	2.32.4-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-6229 is a medium vulnerability (CVSS 6.1) in Apple Icloud, published February 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in webkit2gtk 2.22.7-r0.

References

Show 153 moreShow less