CVE-2019-8771
published 2020-10-27CVE-2019-8771: This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate…
PriorityP179medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.98%
58.4th percentile
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | ios | >= unspecified < 13 | 13 |
| apple | iphone_os | < 13.0. | 13.0. |
| apple | safari | < 13.0.1 | 13.0.1 |
| apple | safari | — | — |
| apple | safari | >= unspecified < 13.0 | 13.0 |
| debian | webkit2gtk | < webkit2gtk 2.26.0-1 (bookworm) | webkit2gtk 2.26.0-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerable versions: WebKitGTK before 2.26.0 and WPE WebKit before 2.26.0 are affected by the iframe sandboxing policy violation. ↗
- ·This vulnerability is in the WebKit iframe sandbox enforcement logic; maliciously crafted web content can violate iframe sandboxing policy. Detection should focus on anomalous iframe sandbox attribute bypass behavior in WebKit-based browsers/engines. ↗
- ·Red Hat Enterprise Linux 6 (webkitgtk) is out of support scope and will not receive a fix; RHEL 7 (webkitgtk3) was initially marked 'Will not fix' but was later addressed via RHSA-2020:4035. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vulncheck6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
WebKitGTK+ vulnerabilities
vendor_ubuntu·2019-11-07
CVE-2019-8625 WebKitGTK+ vulnerabilities
Title: WebKitGTK+ vulnerabilities
Summary: Several security issues were fixed in WebKitGTK+.
A large number of security issues were discovered in the WebKitGTK+ Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
Red Hat
webkitgtk: Violation of iframe sandboxing policy
vendor_redhat·2019-10-29·CVSS 6.1
CVE-2019-8771 [MEDIUM] webkitgtk: Violation of iframe sandboxing policy
webkitgtk: Violation of iframe sandboxing policy
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Out of support scope
Package: webkitgtk3 (Red Hat Enterprise Linux 7) - Will not fix
Apple
CVE-2019-8771: Safari 13.0.1
vendor_apple·2019-09-24·CVSS 6.1
CVE-2019-8771 [MEDIUM] CVE-2019-8771: Safari 13.0.1
Apple Security Update: About the security content of Safari 13.0.1
Product: Safari
Version: 13.0.1
CVE: CVE-2019-8771
Component: WebKit
Impact: Maliciously crafted web content may violate iframe sandboxing policy
Description: This issue was addressed with improved iframe sandbox enforcement.
Apple
CVE-2019-8771: iOS 13
vendor_apple·2019-09-19·CVSS 6.1
CVE-2019-8771 [MEDIUM] CVE-2019-8771: iOS 13
Apple Security Update: About the security content of iOS 13
Product: iOS
Version: 13
CVE: CVE-2019-8771
Component: WebKit
Impact: Maliciously crafted web content may violate iframe sandboxing policy
Description: This issue was addressed with improved iframe sandbox enforcement.
Debian
CVE-2019-8771: webkit2gtk - This issue was addressed with improved iframe sandbox enforcement. This issue is...
vendor_debian·2019·CVSS 6.1
CVE-2019-8771 [MEDIUM] CVE-2019-8771: webkit2gtk - This issue was addressed with improved iframe sandbox enforcement. This issue is...
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy.
Scope: local
bookworm: resolved (fixed in 2.26.0-1)
bullseye: resolved (fixed in 2.26.0-1)
forky: resolved (fixed in 2.26.0-1)
sid: resolved (fixed in 2.26.0-1)
trixie: resolved (fixed in 2.26.0-1)
GHSA
GHSA-w6pm-jp6h-x3pq: This issue was addressed with improved iframe sandbox enforcement
ghsa_unreviewed·2022-05-24
CVE-2019-8771 [MEDIUM] CWE-1021 GHSA-w6pm-jp6h-x3pq: This issue was addressed with improved iframe sandbox enforcement
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy.
OSV
CVE-2019-8771: This issue was addressed with improved iframe sandbox enforcement
osv·2020-10-27·CVSS 6.1
CVE-2019-8771 [MEDIUM] CVE-2019-8771: This issue was addressed with improved iframe sandbox enforcement
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy.
VulnCheck
Apple safari Improper Restriction of Rendered UI Layers or Frames
vulncheck·2019·CVSS 6.1
CVE-2019-8771 [MEDIUM] Apple safari Improper Restriction of Rendered UI Layers or Frames
Apple safari Improper Restriction of Rendered UI Layers or Frames
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy.
Affected: Apple safari
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blog.confiant.com/malvertiser-egobbler-exploits-chrome-webkit-bugs-infects-over-1-billion-ads-6b8ccc41b0e6
No detection rules found.
No public exploits indexed.
2020-10-27
Published
Exploited in the wild