MEDIUM
webkitgtk: Incorrect state management leading to universal cross-site scripting
Published Dec 18, 2019
6.1
MEDIUMCVSS 3.1
EPSS 1.32%
Description
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<Safari 13.0.3
- Version
-
- Version unspecifiedStatusaffectedConstraints<iCloud for Windows 11.0
- Version
-
- Version unspecifiedStatusaffectedConstraints<iOS 13.2 and iPadOS 13.2
- Version
-
- Version unspecifiedStatusaffectedConstraints<iTunes for Windows 12.10.2
- Version
-
- Version unspecifiedStatusaffectedConstraints<tvOS 13.2
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apple | Safari | n/a |
| ||||||
| Apple | iCloud for Windows | n/a |
| ||||||
| Apple | iOS | n/a |
| ||||||
| Apple | iTunes for Windows | n/a |
| ||||||
| Apple | tvOS | n/a |
|
No data.
Red Hat Enterprise Linux 7
webkitgtk4-0:2.28.2-2.el7
Fixed · RHSA-2020:4035
Red Hat Enterprise Linux 8
webkit2gtk3-0:2.28.4-1.el8
Fixed · RHSA-2020:4451
Red Hat Enterprise Linux 6
webkitgtk
Out of support scope
Red Hat Enterprise Linux 7
webkitgtk3
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | webkitgtk4-0:2.28.2-2.el7 | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux 8 | webkit2gtk3-0:2.28.4-1.el8 | Fixed | RHSA-2020:4451 |
| Red Hat Enterprise Linux 6 | webkitgtk | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | webkitgtk3 | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (12)
- https://access.redhat.com/security/cve/CVE-2019-8813 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1876553 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-18203 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-8813
- https://security.gentoo.org/glsa/202003-22 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://support.apple.com/HT210721 x_refsource_MISCVendor Advisory
- https://support.apple.com/HT210723 x_refsource_MISCVendor Advisory
- https://support.apple.com/HT210725 x_refsource_MISCVendor Advisory
- https://support.apple.com/HT210726 x_refsource_MISCVendor Advisory
- https://support.apple.com/HT210727 x_refsource_MISCVendor Advisory
- https://webkitgtk.org/security/WSA-2019-0006.html
- https://www.cve.org/CVERecord?id=CVE-2019-8813
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-8813 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1876553 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-18203 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-8813 | ||
| https://security.gentoo.org/glsa/202003-22 | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| https://support.apple.com/HT210721 | x_refsource_MISCVendor Advisory | |
| https://support.apple.com/HT210723 | x_refsource_MISCVendor Advisory | |
| https://support.apple.com/HT210725 | x_refsource_MISCVendor Advisory | |
| https://support.apple.com/HT210726 | x_refsource_MISCVendor Advisory | |
| https://support.apple.com/HT210727 | x_refsource_MISCVendor Advisory | |
| https://webkitgtk.org/security/WSA-2019-0006.html | ||
| https://www.cve.org/CVERecord?id=CVE-2019-8813 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apple
Published Dec 18, 2019
Updated Aug 4, 2024
Reserved Feb 18, 2019
Link CVE-2019-8813
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2019-18203 Assigner apple
Published Dec 18, 2019
Updated Aug 4, 2024
Exploited since n/a
Link EUVD-2019-18203