Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-11646 — Webkitgtk vulnerability

7 documents6 sources
Severity
7.5HIGHNVD
EPSS
75.3%
top 1.11%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Debian Webkit2gtkWebkitgtk
Timeline
PublishedJun 1
Latest updateMay 13

Description

webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶debiandebian/webkit2gtk< webkit2gtk 2.20.3-1 (bookworm)

Patches

Patch: bugs.webkit.org ↗Patch: bugs.webkit.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-q2c8-4vmf-78h5: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase↗2022-05-13
▶
OSV
CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase↗2018-06-01
▶

💥Exploits & PoCs

3
Exploit-DB
WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' Denial of Service (Metasploit)↗2018-06-11
▶
Exploit-DB
WebKitGTK+ < 2.21.3 - Crash (PoC)↗2018-06-05
▶
Metasploit
WebKitGTK+ WebKitFaviconDatabase DoS↗
▶

📋Vendor Advisories

1
Debian
CVE-2018-11646: webkit2gtk - webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPag...↗2018
▶