CVE-2018-12911 — Out-of-bounds Write in Webkitgtk

CWE-787 — Out-of-bounds Write5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 34.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Webkit2gtkCanonical Ubuntu LinuxWebkitgtk
Timeline
PublishedJul 19
Latest updateMay 14

Description

WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶debiandebian/webkit2gtk< webkit2gtk 2.20.4-1 (bookworm)

Also affects: Ubuntu Linux 16.04, 18.04

Patches

Patch: trac.webkit.org ↗Patch: trac.webkit.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-jc5j-6mrr-7p3r: WebKitGTK+ 2↗2022-05-14
▶
OSV
CVE-2018-12911: WebKitGTK+ 2↗2018-07-19
▶

📋Vendor Advisories

2
Ubuntu
WebKitGTK+ vulnerabilities↗2018-08-16
▶
Debian
CVE-2018-12911: webkit2gtk - WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write,...↗2018
▶