{"id":"CVE-2018-4133","aliases":["DEBIAN-CVE-2018-4133","EUVD-2018-15919","GHSA-8r9c-gc7v-2v7w","MGASA-2018-0213","SUSE-SU-2018:3387-1","UBUNTU-CVE-2018-4133","USN-3635-1","openSUSE-SU-2024:11506-1"],"status":"published","title":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue...","description":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the \"WebKit\" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01485,"percentile":0.74188,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-04-03T00:00:00Z","modified":"2026-10-23T18:03:58Z","fixes":[{"ecosystem":"Debian:12","package":"webkit2gtk","fixed_in":["2.20.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"webkit2gtk","fixed_in":["2.20.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"webkit2gtk","fixed_in":["2.20.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","fixed_in":["2.20.1-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-2"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"webkit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.1-1.mga6"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.3-2.23.8"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.3-2.23.8"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.3-2.23.8"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.3-2.23.8"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.3-2.23.8"}]}],"bundled":40},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.1-0ubuntu0.16.04.1"}]}],"versions":["2.8.5+dfsg1-3","2.10.3+dfsg1-1","2.10.4+dfsg1-1","2.10.5-1","2.10.6-1","2.10.6-1ubuntu1","2.10.8-1ubuntu1","2.10.9-1ubuntu1","2.12.5-0ubuntu0.16.04.1","2.14.2-0ubuntu0.16.04.1","2.14.3-0ubuntu0.16.04.1","2.14.5-0ubuntu0.16.04.1","2.16.1-0ubuntu0.16.04.1","2.16.1-0ubuntu0.16.04.2","2.16.2-0ubuntu0.16.04.1","2.16.3-0ubuntu0.16.04.1","2.16.6-0ubuntu0.16.04.1","2.18.0-0ubuntu0.16.04.2","2.18.3-0ubuntu0.16.04.1","2.18.4-0ubuntu0.16.04.1","2.18.5-0ubuntu0.16.04.1","2.18.6-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-1ubuntu2.1","5.5.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu10","2.3.2-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-5ubuntu1","5.9.1+dfsg-5ubuntu3","5.212.0~alpha2-5build2","5.212.0~alpha2-5build4","5.212.0~alpha2-7","5.212.0~alpha2-7build2","5.212.0~alpha2-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu13"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.11-3","2.4.11-3ubuntu2","2.4.11-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.212.0~alpha3-3","5.212.0~alpha3-5","5.212.0~alpha3-6","5.212.0~alpha3-7","5.212.0~alpha4-1","5.212.0~alpha4-1ubuntu1","5.212.0~alpha4-1ubuntu2","5.212.0~alpha4-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.212.0~alpha4-12","5.212.0~alpha4-13","5.212.0~alpha4-14","5.212.0~alpha4-14build1","5.212.0~alpha4-14ubuntu2","5.212.0~alpha4-15ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.212.0~alpha4-33","5.212.0~alpha4-33build1","5.212.0~alpha4-34","5.212.0~alpha4-34ubuntu3","5.212.0~alpha4-34ubuntu4","5.212.0~alpha4-36"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.1-0ubuntu0.16.04.1"}]}],"versions":["2.8.5+dfsg1-3","2.10.3+dfsg1-1","2.10.4+dfsg1-1","2.10.5-1","2.10.6-1","2.10.6-1ubuntu1","2.10.8-1ubuntu1","2.10.9-1ubuntu1","2.12.5-0ubuntu0.16.04.1","2.14.2-0ubuntu0.16.04.1","2.14.3-0ubuntu0.16.04.1","2.14.5-0ubuntu0.16.04.1","2.16.1-0ubuntu0.16.04.1","2.16.1-0ubuntu0.16.04.2","2.16.2-0ubuntu0.16.04.1","2.16.3-0ubuntu0.16.04.1","2.16.6-0ubuntu0.16.04.1","2.18.0-0ubuntu0.16.04.2","2.18.3-0ubuntu0.16.04.1","2.18.4-0ubuntu0.16.04.1","2.18.5-0ubuntu0.16.04.1","2.18.6-0ubuntu0.16.04.1"],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4-1.1"}]}],"bundled":126}],"products":[{"vendor":"apple","product":"safari"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"webkitgtk","product":"webkitgtk\\+"}],"references":[{"url":"http://www.securityfocus.com/bid/103580","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201808-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1040606","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://usn.ubuntu.com/3635-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/HT208695","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-4133"},{"url":"https://github.com/advisories/GHSA-8r9c-gc7v-2v7w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-4133","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0213.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22876","tags":["report"]},{"url":"https://www.webkitgtk.org/security/WSA-2018-0003.html","tags":["web"]},{"url":"https://www.webkitgtk.org/2018/03/12/webkitgtk2.20.0-released.html","tags":["web"]},{"url":"https://www.webkitgtk.org/2018/04/10/webkitgtk2.20.1-released.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183387-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1075775","tags":["report"]},{"url":"https://bugzilla.suse.com/1077535","tags":["report"]},{"url":"https://bugzilla.suse.com/1079512","tags":["report"]},{"url":"https://bugzilla.suse.com/1088182","tags":["report"]},{"url":"https://bugzilla.suse.com/1088932","tags":["report"]},{"url":"https://bugzilla.suse.com/1092278","tags":["report"]},{"url":"https://bugzilla.suse.com/1092279","tags":["report"]},{"url":"https://bugzilla.suse.com/1092280","tags":["report"]},{"url":"https://bugzilla.suse.com/1095611","tags":["report"]},{"url":"https://bugzilla.suse.com/1096060","tags":["report"]},{"url":"https://bugzilla.suse.com/1096061","tags":["report"]},{"url":"https://bugzilla.suse.com/1097693","tags":["report"]},{"url":"https://bugzilla.suse.com/1101999","tags":["report"]},{"url":"https://bugzilla.suse.com/1102530","tags":["report"]},{"url":"https://bugzilla.suse.com/1104169","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4246","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-4133","tags":["report"]},{"url":"https://webkitgtk.org/security/WSA-2018-0003.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3635-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-4165","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30858","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-4133","description":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the \"WebKit\" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","status":"published","published":"2018-04-03T06:00:00Z","modified":"2024-08-05T05:04:29.749Z","updated_at":"2026-11-02T14:35:08.024147Z"}],"euvd":[{"id":"EUVD-2018-15919","description":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the \"WebKit\" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","status":"published","published":"2018-04-03T06:00:00Z","modified":"2024-08-05T05:04:29Z","updated_at":"2026-11-03T02:40:14.678776Z"}],"ghsa":[{"id":"GHSA-8r9c-gc7v-2v7w","title":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue...","description":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the \"WebKit\" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","status":"published","published":"2022-05-14T02:00:26Z","modified":"2023-02-02T05:04:54Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:51:58.811434Z"}],"nvd":[{"id":"CVE-2018-4133","description":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the \"WebKit\" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","status":"published","published":"2018-04-03T06:29:06.047Z","modified":"2026-06-17T01:58:25.637Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"CVE-2018-4133","description":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the \"WebKit\" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","status":"published","published":"2018-04-03T06:29:06.047Z","modified":"2026-04-16T06:19:12.583482704Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.442568Z"},{"id":"DEBIAN-CVE-2018-4133","description":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the \"WebKit\" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","status":"published","published":"2018-04-03T06:29:06.047Z","modified":"2026-10-23T18:03:58.290992044Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"UBUNTU-CVE-2018-4133","description":"An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the \"WebKit\" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","status":"published","published":"2018-04-03T00:00:00Z","modified":"2026-04-22T11:55:50.947964Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:18.33562Z"},{"id":"MGASA-2018-0213","title":"Updated webkit2 packages fix security vulnerabilities","description":"The webkit2 package has been updated to version 2.20.1, fixing several\nsecurity issues and other bugs.\n","status":"published","published":"2018-04-30T19:08:07Z","modified":"2026-04-16T06:23:26.073690286Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11506-1","title":"libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media","description":"These are all security issues fixed in the libjavascriptcoregtk-4_0-18-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:53.710181Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:3387-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 to version 2.20.3 fixes the issues:\n\nThe following security vulnerabilities were addressed:\n\n- CVE-2018-12911: Fixed an off-by-one error in xdg_mime_get_simple_globs\n  (boo#1101999)\n- CVE-2017-13884: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1075775).\n- CVE-2017-13885: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1075775).\n- CVE-2017-7153: An unspecified issue allowed remote attackers to spoof\n  user-interface information (about whether the entire content is derived from a\n  valid TLS session) via a crafted web site that sends a 401 Unauthorized\n  redirect (bsc#1077535).\n- CVE-2017-7160: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1075775).\n- CVE-2017-7161: An unspecified issue allowed remote attackers to execute\n  arbitrary code via special characters that trigger command injection\n  (bsc#1075775, bsc#1077535).\n- CVE-2017-7165: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1075775).\n- CVE-2018-4088: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1075775).\n- CVE-2018-4096: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1075775).\n- CVE-2018-4200: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site that triggers a\n  WebCore::jsElementScrollHeightGetter use-after-free (bsc#1092280).\n- CVE-2018-4204: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1092279).\n- CVE-2018-4101: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4113: An issue in the JavaScriptCore function in the 'WebKit'\n  component allowed attackers to trigger an assertion failure by leveraging\n  improper array indexing (bsc#1088182)\n- CVE-2018-4114: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182) \n- CVE-2018-4117: An unspecified issue allowed remote attackers to bypass the\n  Same Origin Policy and obtain sensitive information via a crafted web site\n  (bsc#1088182, bsc#1102530).\n- CVE-2018-4118: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182) \n- CVE-2018-4119: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182) \n- CVE-2018-4120: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4121: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1092278).\n- CVE-2018-4122: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4125: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4127: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4128: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4129: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4146: An unspecified issue allowed attackers to cause a denial of\n  service (memory corruption) via a crafted web site (bsc#1088182).\n- CVE-2018-4161: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4162: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4163: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4165: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1088182).\n- CVE-2018-4190: An unspecified issue allowed remote attackers to obtain\n  sensitive credential information that is transmitted during a CSS mask-image\n  fetch (bsc#1097693)\n- CVE-2018-4199: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (buffer overflow and application\n  crash) via a crafted web site (bsc#1097693)\n- CVE-2018-4218: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site that triggers an @generatorState use-after-free\n  (bsc#1097693)\n- CVE-2018-4222: An unspecified issue allowed remote attackers to execute\n  arbitrary code via a crafted web site that leverages a getWasmBufferFromValue\n  out-of-bounds read during WebAssembly compilation (bsc#1097693) \n- CVE-2018-4232: An unspecified issue allowed remote attackers to overwrite\n  cookies via a crafted web site (bsc#1097693) \n- CVE-2018-4233: An unspecified issue allowed remote attackers to execute\n  arbitrary code or cause a denial of service (memory corruption and application\n  crash) via a crafted web site (bsc#1097693) \n- CVE-2018-4246: An unspecified issue allowed remote attackers to execute\n  arbitrary code via a crafted web site that leverages type confusion\n  (bsc#1104169) \n- CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and\n  webkitFaviconDatabaseSetIconURLForPageURL mishandled an unset pageURL, leading\n  to an application crash (bsc#1095611)\n- CVE-2018-4133: A Safari cross-site scripting (XSS) vulnerability allowed\n  remote attackers to inject arbitrary web script or HTML via a crafted URL\n  (bsc#1088182).\n- CVE-2018-11713: The libsoup network backend of WebKit unexpectedly failed to\n  use system proxy settings for WebSocket connections. As a result, users could\n  be deanonymized by crafted web sites via a WebSocket connection (bsc#1096060).\n- CVE-2018-11712: The libsoup network backend of WebKit failed to perform TLS\n  certificate verification for WebSocket connections (bsc#1096061).\n\n\nThis update for webkit2gtk3 fixes the following issues:\n\n- Fixed a crash when atk_object_ref_state_set is called on an AtkObject that's\n  being destroyed (bsc#1088932).\n- Fixed crash when using Wayland with QXL/virtio (bsc#1079512)\n- Disable Gigacage if mmap fails to allocate in Linux.\n- Add user agent quirk for paypal website.\n- Properly detect compiler flags, needed libs, and fallbacks for\n  usage of 64-bit atomic operations.\n- Fix a network process crash when trying to get cookies of\n  about:blank page.\n- Fix UI process crash when closing the window under Wayland.\n- Fix several crashes and rendering issues.\n- Do TLS error checking on GTlsConnection::accept-certificate to\n  finish the load earlier in case of errors.\n- Properly close the connection to the nested wayland compositor\n  in the Web Process.\n- Avoid painting backing stores for zero-opacity layers.\n- Fix downloads started by context menu failing in some websites\n  due to missing user agent HTTP header.\n- Fix video unpause when GStreamerGL is disabled.\n- Fix several GObject introspection annotations.\n- Update user agent quiks to fix Outlook.com and Chase.com.\n- Fix several crashes and rendering issues.\n- Improve error message when Gigacage cannot allocate virtual memory.\n- Add missing WebKitWebProcessEnumTypes.h to webkit-web-extension.h.\n- Improve web process memory monitor thresholds.\n- Fix a web process crash when the web view is created and destroyed quickly.\n- Fix a network process crash when load is cancelled while searching for\n  stored HTTP auth credentials.\n- Fix the build when ENABLE_VIDEO, ENABLE_WEB_AUDIO and\n  ENABLE_XSLT are disabled.\n- New API to retrieve and delete cookies with WebKitCookieManager.\n- New web process API to detect when form is submitted via JavaScript.\n- Several improvements and fixes in the touch/gestures support.\n- Support for the “system” CSS font family.\n- Complex text rendering improvements and fixes.\n- More complete and spec compliant WebDriver implementation.\n- Ensure DNS prefetching cannot be re-enabled if disabled by settings.\n- Fix seek sometimes not working.\n- Fix rendering of emojis that were using the wrong scale factor\n  in some cases.\n- Fix rendering of combining enclosed keycap.\n- Fix rendering scale of some layers in HiDPI.\n- Fix a crash in Wayland when closing the web view.\n- Fix crashes upower crashes when running inside a chroot or on\n  systems with broken dbus/upower.\n- Fix memory leaks in GStreamer media backend when using\n  GStreamer 1.14.\n- Fix several crashes and rendering issues.\n- Add ENABLE_ADDRESS_SANITIZER to make it easier to build with\n  asan support.\n- Fix a crash a under Wayland when using mesa software\n  rasterization.\n- Make fullscreen video work again.\n- Fix handling of missing GStreamer elements.\n- Fix rendering when webm video is played twice.\n- Fix kinetic scrolling sometimes jumping around.\n- Fix build with ICU configured without collation support.\n- WebSockets use system proxy settings now (requires libsoup 2.61.90).\n- Show the context menu on long-press gesture.\n- Add support for Shift + mouse scroll to scroll horizontally.\n- Fix zoom gesture to actually zoom instead of changing the page\n  scale.\n- Implement support for Graphics ARIA roles.\n- Make sleep inhibitors work under Flatpak.\n- Add get element CSS value command to WebDriver.\n- Fix a crash aftter a swipe gesture.\n- Fix several crashes and rendering issues.\n- Fix crashes due to duplicated symbols in libjavascriptcoregtk\n  and libwebkit2gtk.\n- Fix parsing of timeout values in WebDriver.\n- Implement get timeouts command in WebDriver.\n- Fix deadlock in GStreamer video sink during shutdown when\n  accelerated compositing is disabled.\n- Fix several crashes and rendering issues.\n- Add web process API to detect when form is submitted via\n  JavaScript.\n- Add new API to replace\n  webkit_form_submission_request_get_text_fields() that is now\n  deprecated.\n- Add WebKitWebView::web-process-terminated signal and deprecate\n  web-process-crashed.\n- Fix rendering issues when editing text areas.\n- Use FastMalloc based GstAllocator for GStreamer.\n- Fix web process crash at startup in bmalloc.\n- Fix several memory leaks in GStreamer media backend.\n- WebKitWebDriver process no longer links to\n  libjavascriptcoregtk.\n- Fix several crashes and rendering issues.\n- Add new API to add, retrieve and delete cookies via\n  WebKitCookieManager.\n- Add functions to WebSettings to convert font sizes between\n  points and pixels.\n- Ensure cookie operations take effect when they happen before a\n  web process has been spawned.\n- Automatically adjust font size when GtkSettings:gtk-xft-dpi\n  changes.\n- Add initial resource load statistics support.\n- Add API to expose availability of certain editing commands in\n  WebKitEditorState.\n- Add API to query whether a WebKitNavigationAction is a redirect\n  or not.\n- Improve complex text rendering.\n- Add support for the 'system' CSS font family.\n- Disable USE_GSTREAMER_GL\n","status":"published","published":"2018-10-24T11:31:35Z","modified":"2026-02-04T03:19:56.540261Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3635-1","title":"webkit2gtk vulnerabilities","description":"A large number of security issues were discovered in the WebKitGTK+ Web and\nJavaScript engines. If a user were tricked into viewing a malicious\nwebsite, a remote attacker could exploit a variety of issues related to web\nbrowser security, including cross-site scripting attacks, denial of service\nattacks, and arbitrary code execution.\n","status":"published","published":"2018-04-30T16:25:25Z","modified":"2026-04-22T09:44:39.488845Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}