| Package | Affected versions | Patched versions |
|---|---|---|
| webkitgtk | ≤ 2.23.90 | |
| webkitgtk+ | ≤ 2.22.6 |
The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free