{"id":"CVE-2019-8375","aliases":["DEBIAN-CVE-2019-8375","EUVD-2019-17765","GHSA-f6vf-7m59-gfmp","SUSE-SU-2019:0890-1","SUSE-SU-2019:1030-1","UBUNTU-CVE-2019-8375","USN-3948-1","openSUSE-SU-2019:1206-1","openSUSE-SU-2024:11506-1"],"status":"published","title":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2...","description":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.15697,"percentile":0.96884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2019-02-24T00:00:00Z","modified":"2026-09-21T07:03:24Z","exploits":[{"source":"exploitdb","id":"EDB-46465","title":"WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 - Denial of Service","type":"dos","platform":"linux","date":"2019-02-28","url":"https://www.exploit-db.com/exploits/46465"}],"fixes":[{"ecosystem":"Debian:12","package":"webkit2gtk","fixed_in":["2.24.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"webkit2gtk","fixed_in":["2.24.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"webkit2gtk","fixed_in":["2.24.1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"webkit2gtk3","fixed_in":["2.24.0-3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"webkit2gtk3","fixed_in":["2.24.0-3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"webkit2gtk3","fixed_in":["2.24.0-2.38.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"webkit2gtk","fixed_in":["2.24.1-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"webkit2gtk3","fixed_in":["2.24.0-lp150.2.16.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-2.38.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-1ubuntu2.1","5.5.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.5+dfsg1-3","2.10.3+dfsg1-1","2.10.4+dfsg1-1","2.10.5-1","2.10.6-1","2.10.6-1ubuntu1","2.10.8-1ubuntu1","2.10.9-1ubuntu1","2.12.5-0ubuntu0.16.04.1","2.14.2-0ubuntu0.16.04.1","2.14.3-0ubuntu0.16.04.1","2.14.5-0ubuntu0.16.04.1","2.16.1-0ubuntu0.16.04.1","2.16.1-0ubuntu0.16.04.2","2.16.2-0ubuntu0.16.04.1","2.16.3-0ubuntu0.16.04.1","2.16.6-0ubuntu0.16.04.1","2.18.0-0ubuntu0.16.04.2","2.18.3-0ubuntu0.16.04.1","2.18.4-0ubuntu0.16.04.1","2.18.5-0ubuntu0.16.04.1","2.18.6-0ubuntu0.16.04.1","2.20.1-0ubuntu0.16.04.1","2.20.2-0ubuntu0.16.04.1","2.20.3-0ubuntu0.16.04.1","2.20.5-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu10","2.3.2-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.1-0ubuntu0.18.04.1"}]}],"versions":["2.18.0-2","2.18.0-2build1","2.18.2-1","2.18.3-1","2.18.4-1","2.18.6-1","2.19.91-1ubuntu1","2.19.92-1","2.20.0-1","2.20.0-2","2.20.0-2ubuntu1","2.20.1-1","2.20.2-0ubuntu0.18.04.1","2.20.3-0ubuntu0.18.04.1","2.20.5-0ubuntu0.18.04.1","2.22.2-0ubuntu0.18.04.1","2.22.2-0ubuntu0.18.04.2","2.22.4-0ubuntu0.18.04.1","2.22.5-0ubuntu0.18.04.1","2.22.6-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-5ubuntu1","5.9.1+dfsg-5ubuntu3","5.212.0~alpha2-5build2","5.212.0~alpha2-5build4","5.212.0~alpha2-7","5.212.0~alpha2-7build2","5.212.0~alpha2-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu13"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.11-3","2.4.11-3ubuntu2","2.4.11-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.212.0~alpha3-3","5.212.0~alpha3-5","5.212.0~alpha3-6","5.212.0~alpha3-7","5.212.0~alpha4-1","5.212.0~alpha4-1ubuntu1","5.212.0~alpha4-1ubuntu2","5.212.0~alpha4-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.212.0~alpha4-12","5.212.0~alpha4-13","5.212.0~alpha4-14","5.212.0~alpha4-14build1","5.212.0~alpha4-14ubuntu2","5.212.0~alpha4-15ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.212.0~alpha4-33","5.212.0~alpha4-33build1","5.212.0~alpha4-34","5.212.0~alpha4-34ubuntu3","5.212.0~alpha4-34ubuntu4","5.212.0~alpha4-36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.1-0ubuntu0.18.04.1"}]}],"versions":["2.18.0-2","2.18.0-2build1","2.18.2-1","2.18.3-1","2.18.4-1","2.18.6-1","2.19.91-1ubuntu1","2.19.92-1","2.20.0-1","2.20.0-2","2.20.0-2ubuntu1","2.20.1-1","2.20.2-0ubuntu0.18.04.1","2.20.3-0ubuntu0.18.04.1","2.20.5-0ubuntu0.18.04.1","2.22.2-0ubuntu0.18.04.1","2.22.2-0ubuntu0.18.04.2","2.22.4-0ubuntu0.18.04.1","2.22.5-0ubuntu0.18.04.1","2.22.6-0ubuntu0.18.04.1"],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"webkit2gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-lp150.2.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4-1.1"}]}],"bundled":126}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"webkitgtk","product":"webkitgtk"},{"vendor":"webkitgtk","product":"webkitgtk\\+"}],"references":[{"url":"https://trac.webkit.org/changeset/241515/webkit","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://www.exploit-db.com/exploits/46465/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://github.com/WebKit/webkit/commit/6f9b511a115311b13c06eb58038ddc2c78da5531","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.inputzero.io/2019/02/fuzzing-webkit.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://bugs.webkit.org/show_bug.cgi?id=184875","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Permissions Required","Third Party Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00058.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3948-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8375"},{"url":"https://github.com/advisories/GHSA-f6vf-7m59-gfmp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-8375","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190890-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1126768","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8375","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191030-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-8375","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3948-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-8375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-8563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11070","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/B3HW6YDRCI5JKJU4FUJEBPP26LUQJZET/#B3HW6YDRCI5JKJU4FUJEBPP26LUQJZET","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-4443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30858","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-8375","description":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).","status":"published","published":"2019-02-24T13:00:00Z","modified":"2024-08-04T21:17:31.297Z","updated_at":"2026-11-02T14:20:22.019351Z"}],"euvd":[{"id":"EUVD-2019-17765","description":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).","status":"published","published":"2019-02-24T13:00:00Z","modified":"2024-08-04T21:17:31Z","updated_at":"2026-11-03T03:06:42.975045Z"}],"ghsa":[{"id":"GHSA-f6vf-7m59-gfmp","title":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2...","description":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).","status":"published","published":"2022-05-14T01:04:30Z","modified":"2023-02-02T05:02:55Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:32.364862Z"}],"nvd":[{"id":"CVE-2019-8375","description":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).","status":"published","published":"2019-02-24T13:29:00.357Z","modified":"2026-06-17T02:41:54.783Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"CVE-2019-8375","description":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).","status":"published","published":"2019-02-24T13:29:00.357Z","modified":"2026-03-15T22:29:45.751694Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-8375","description":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).","status":"published","published":"2019-02-24T13:29:00.357Z","modified":"2026-09-21T07:03:24.062202764Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-8375","description":"The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).","status":"published","published":"2019-02-24T00:00:00Z","modified":"2026-04-22T12:21:53.060075Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"openSUSE-SU-2019:1206-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 to version 2.24.0 fixes the following issue:\n\nSecurity issue fixed: \n\n- CVE-2019-8375: Fixed an issue in UIProcess subsystem which could allow the script dialog\n  size to exceed the web view size leading to Buffer Overflow or other unspecified impact (bsc#1126768).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-15T14:33:44Z","modified":"2026-02-04T03:09:52.528492Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11506-1","title":"libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media","description":"These are all security issues fixed in the libjavascriptcoregtk-4_0-18-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:53.710181Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:0890-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 to version 2.24.0 fixes the following issue:\n\nSecurity issue fixed: \n\n- CVE-2019-8375: Fixed an issue in UIProcess subsystem which could allow the script dialog\n  size to exceed the web view size leading to Buffer Overflow or other unspecified impact (bsc#1126768).\n","status":"published","published":"2019-04-05T11:31:34Z","modified":"2026-02-04T03:53:33.706618Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1030-1","title":"Security update for webkit2gtk3","description":"This update for webkit2gtk3 fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2019-8375: Fixed an issue in UIProcess subsystem which could allow the script dialog\n  size to exceed the web view size leading to Buffer Overflow or other unspecified impact (bsc#1126768).\t  \n","status":"published","published":"2019-04-25T07:50:08Z","modified":"2026-02-04T04:08:52.694458Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3948-1","title":"webkit2gtk vulnerabilities","description":"A large number of security issues were discovered in the WebKitGTK+ Web and\nJavaScript engines. If a user were tricked into viewing a malicious\nwebsite, a remote attacker could exploit a variety of issues related to web\nbrowser security, including cross-site scripting attacks, denial of service\nattacks, and arbitrary code execution.\n","status":"published","published":"2019-04-16T13:45:32Z","modified":"2026-04-22T09:55:10.07418Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}