{"id":"CVE-2017-2371","aliases":["DEBIAN-CVE-2017-2371","EUVD-2017-11554","GHSA-p7jw-mhp8-p9j3","MGASA-2017-0069","SUSE-SU-2017:2933-1","SUSE-SU-2018:0219-1","UBUNTU-CVE-2017-2371","USN-3200-1","openSUSE-SU-2024:11506-1"],"status":"published","title":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue...","description":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the \"WebKit\" component, which allows remote attackers to launch popups via a crafted web site.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05766,"percentile":0.93137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2017-02-16T00:00:00Z","modified":"2026-10-08T12:50:01Z","exploits":[{"source":"exploitdb","id":"EDB-41451","title":"Apple WebKit 10.0.2 - Cross-Origin or Sandboxed IFRAME Pop-up Blocker Bypass","type":"webapps","platform":"multiple","date":"2017-02-24","verified":true,"url":"https://www.exploit-db.com/exploits/41451"}],"fixes":[{"ecosystem":"Debian:12","package":"webkit2gtk","fixed_in":["2.14.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"webkit2gtk","fixed_in":["2.14.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"webkit2gtk","fixed_in":["2.14.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","fixed_in":["2.14.5-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.4-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"webkit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.5-1.mga5"}]}],"bundled":60},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-2.9.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.5-2.18.1"}]}],"bundled":89},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.5-0ubuntu0.16.04.1"}]}],"versions":["2.8.5+dfsg1-3","2.10.3+dfsg1-1","2.10.4+dfsg1-1","2.10.5-1","2.10.6-1","2.10.6-1ubuntu1","2.10.8-1ubuntu1","2.10.9-1ubuntu1","2.12.5-0ubuntu0.16.04.1","2.14.2-0ubuntu0.16.04.1","2.14.3-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-1ubuntu2.1","5.5.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu10","2.3.2-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.5-0ubuntu0.16.04.1"}]}],"versions":["2.8.5+dfsg1-3","2.10.3+dfsg1-1","2.10.4+dfsg1-1","2.10.5-1","2.10.6-1","2.10.6-1ubuntu1","2.10.8-1ubuntu1","2.10.9-1ubuntu1","2.12.5-0ubuntu0.16.04.1","2.14.2-0ubuntu0.16.04.1","2.14.3-0ubuntu0.16.04.1"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4-1.1"}]}],"bundled":126}],"products":[{"vendor":"apple","product":"iphone_os"}],"references":[{"url":"https://www.exploit-db.com/exploits/41451/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201706-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/HT207482","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1037668","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/95735","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2371"},{"url":"https://www.exploit-db.com/exploits/41451"},{"url":"https://github.com/advisories/GHSA-p7jw-mhp8-p9j3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-2371","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0069.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19721","tags":["report"]},{"url":"https://webkitgtk.org/security/WSA-2016-0006.html","tags":["web"]},{"url":"https://webkitgtk.org/security/WSA-2017-0001.html","tags":["web"]},{"url":"https://webkitgtk.org/security/WSA-2017-0002.html","tags":["web","report"]},{"url":"https://webkitgtk.org/2016/09/05/webkitgtk2.12.5-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2016/09/20/webkitgtk2.14.0-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2016/10/11/webkitgtk2.14.1-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2016/11/03/webkitgtk2.14.2-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2017/01/17/webkitgtk2.14.3-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2017/02/10/webkitgtk2.14.4-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2017/02/15/webkitgtk2.14.5-released.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172933-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1020950","tags":["report"]},{"url":"https://bugzilla.suse.com/1024749","tags":["report"]},{"url":"https://bugzilla.suse.com/1045460","tags":["report"]},{"url":"https://bugzilla.suse.com/1050469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7064","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180219-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1066892","tags":["report"]},{"url":"https://bugzilla.suse.com/1069925","tags":["report"]},{"url":"https://bugzilla.suse.com/1073654","tags":["report"]},{"url":"https://bugzilla.suse.com/1075419","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7157","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-2371","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3200-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2373","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30858","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-2371","description":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the \"WebKit\" component, which allows remote attackers to launch popups via a crafted web site.","status":"published","published":"2017-02-20T08:35:00Z","modified":"2024-08-05T13:55:04.115Z","updated_at":"2026-11-02T14:33:15.201133Z"}],"euvd":[{"id":"EUVD-2017-11554","description":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the \"WebKit\" component, which allows remote attackers to launch popups via a crafted web site.","status":"published","published":"2017-02-20T08:35:00Z","modified":"2024-08-05T13:55:04Z","updated_at":"2026-11-03T02:39:21.461773Z"}],"ghsa":[{"id":"GHSA-p7jw-mhp8-p9j3","title":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue...","description":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the \"WebKit\" component, which allows remote attackers to launch popups via a crafted web site.","status":"published","published":"2022-05-13T01:28:44Z","modified":"2025-04-20T03:34:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:41.326693Z"}],"nvd":[{"id":"CVE-2017-2371","description":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the \"WebKit\" component, which allows remote attackers to launch popups via a crafted web site.","status":"published","published":"2017-02-20T08:59:05.37Z","modified":"2026-06-17T01:16:04.273Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:43.325192Z"}],"osv":[{"id":"CVE-2017-2371","description":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the \"WebKit\" component, which allows remote attackers to launch popups via a crafted web site.","status":"published","published":"2017-02-20T08:59:05.37Z","modified":"2026-04-16T06:20:08.09109099Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-2371","description":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the \"WebKit\" component, which allows remote attackers to launch popups via a crafted web site.","status":"published","published":"2017-02-20T08:59:05.37Z","modified":"2026-09-01T20:03:47.315527068Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-2371","description":"An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the \"WebKit\" component, which allows remote attackers to launch popups via a crafted web site.","status":"published","published":"2017-02-16T00:00:00Z","modified":"2026-10-08T12:50:01.039521653Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2017-0069","title":"Updated webkit2 packages fix security vulnerabilities","description":"The webkit2 package has been updated to version 2.14.5, fixing several\nsecurity issues and other bugs.\n","status":"published","published":"2017-03-02T15:11:17Z","modified":"2026-04-16T06:26:13.364299176Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11506-1","title":"libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media","description":"These are all security issues fixed in the libjavascriptcoregtk-4_0-18-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:53.710181Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:2933-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 to version 2.18.0 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-7039: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7018: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7030: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7037: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7034: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7055: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7056: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7064: An issue was fixed that allowed remote attackers to bypass\n  intended memory-read restrictions via a crafted app (bsc#1050469).\n- CVE-2017-7061: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7048: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1050469).\n- CVE-2017-7046: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1050469).\n- CVE-2017-2538: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1045460)\n- CVE-2017-2496: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site.\n- CVE-2017-2539: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site.\n- CVE-2017-2510: An issue was fixed that allowed remote attackers to conduct\n  Universal XSS (UXSS) attacks via a crafted web site that improperly\n  interacts with pageshow events.\n- CVE-2017-2365: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site (bsc#1024749)\n- CVE-2017-2366: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2373: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2363: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site (bsc#1024749)\n- CVE-2017-2362: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2350: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site (bsc#1024749)\n- CVE-2017-2350: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web site\n  (bsc#1024749)\n- CVE-2017-2354: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749).\n- CVE-2017-2355: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (uninitialized memory\n  access and application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2356: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2017-2371: An issue was fixed that allowed remote attackers to launch\n  popups via a crafted web site (bsc#1024749)\n- CVE-2017-2364: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site (bsc#1024749)\n- CVE-2017-2369: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1024749)\n- CVE-2016-7656: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7635: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7654: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7639: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7645: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7652: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7641: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7632: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7599: An issue was fixed that allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web\n  site that used HTTP redirects (bsc#1020950)\n- CVE-2016-7592: An issue was fixed that allowed remote attackers to obtain\n  sensitive information via crafted JavaScript prompts on a web site (bsc#1020950)\n- CVE-2016-7589: An issue was fixed that allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and\n  application crash) via a crafted web site (bsc#1020950)\n- CVE-2016-7623: An issue was fixed that allowed remote attackers to obtain\n  sensitive information via a blob URL on a web site (bsc#1020950)\n- CVE-2016-7586: An issue was fixed that allowed remote attackers to obtain\n  sensitive information via a crafted web site (bsc#1020950)\n\nFor other non-security fixes please check the changelog.\n","status":"published","published":"2017-11-06T08:39:55Z","modified":"2026-02-04T04:40:35.494583Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:0219-1","title":"Security update for webkit2gtk3","description":"\n\nThis update for webkit2gtk3 fixes the following issues:\n\nUpdate to version 2.18.5:\n\n  + Disable SharedArrayBuffers from Web API.\n  + Reduce the precision of 'high' resolution time to 1ms.\n  + bsc#1075419 - Security fixes: includes improvements to mitigate\n    the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715).\n\nUpdate to version 2.18.4:\n\n  + Make WebDriver implementation more spec compliant.\n  + Fix a bug when trying to remove cookies before a web process is\n    spawned.\n  + WebKitWebDriver process no longer links to\n    libjavascriptcoregtk.\n  + Fix several memory leaks in GStreamer media backend.\n  + bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870,\n    CVE-2017-7156, CVE-2017-13856.\n\nUpdate to version 2.18.3:\n\n  + Improve calculation of font metrics to prevent scrollbars from\n    being shown unnecessarily in some cases.\n  + Fix handling of null capabilities in WebDriver implementation.\n  + Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803.\n\nUpdate to version 2.18.2:\n\n  + Fix rendering of arabic text.\n  + Fix a crash in the web process when decoding GIF images.\n  + Fix rendering of wind in Windy.com.\n  + Fix several crashes and rendering issues.\n\nUpdate to version 2.18.1:\n\n  + Improve performance of GIF animations.\n  + Fix garbled display in GMail.\n  + Fix rendering of several material design icons when using the\n    web font.\n  + Fix flickering when resizing the window in Wayland.\n  + Prevent default kerberos authentication credentials from being\n    used in ephemeral sessions.\n  + Fix a crash when webkit_web_resource_get_data() is cancelled.\n  + Correctly handle touchmove and touchend events in\n    WebKitWebView.\n  + Fix the build with enchant 2.1.1.\n  + Fix the build in HPPA and Alpha.\n  + Fix several crashes and rendering issues.\n  + Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089,\n    CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093,\n    CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098,\n    CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104,\n    CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117,\n    CVE-2017-7120, CVE-2017-7142.\n\n- Enable gold linker on s390/s390x on SLE15/Tumbleweed.\n","status":"published","published":"2018-01-25T16:38:07Z","modified":"2026-02-04T03:14:23.295916Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3200-1","title":"webkit2gtk vulnerabilities","description":"A large number of security issues were discovered in the WebKitGTK+ Web and\nJavaScript engines. If a user were tricked into viewing a malicious\nwebsite, a remote attacker could exploit a variety of issues related to web\nbrowser security, including cross-site scripting attacks, denial of service\nattacks, and arbitrary code execution.\n","status":"published","published":"2017-02-16T18:31:27Z","modified":"2026-04-22T09:32:23.004386Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}