CVE-2024-44185

webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-40789

webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-40782

webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ios Ipad Os Ipados and 15 more

CVE-2024-40780

webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-40779

webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-40776

webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-27856

webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-27851

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Mac Os and 11 more

CVE-2024-27838

webkitgtk: A maliciously crafted webpage may be able to fingerprint the user

The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 6 more

CVE-2024-27833

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipad Os Ipados Iphone Os and 9 more

CVE-2024-27808

webkitgtk: Processing web content may lead to arbitrary code execution

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Apple Redhat

Products

Ipad Os Ipados Iphone Os and 11 more

CVE-2024-23284

webkit: processing maliciously crafted web content prevents Content Security Policy from being enforced

A logic issue was addressed with improved state management. This issue is fixed in Safari 17.4, iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Fedoraproject Redhat and 2 more

Products

Ipados Iphone Os Macos and 9 more

CVE-2024-23280

webkit: maliciously crafted webpage may be able to fingerprint the user

An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. A maliciously crafted webpage may be able to fingerprint the user.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Apple Fedoraproject Redhat and 2 more

Products

Ios Ipad Os Ipados and 10 more

CVE-2024-23271

webkitgtk: A malicious website may cause unexpected cross-origin behavior

A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A malicious website may cause unexpected cross-origin behavior.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ios Ipados Iphone Os and 6 more

CVE-2024-23263

webkit: processing malicious web content prevents Content Security Policy from being enforced

A logic issue was addressed with improved validation. This issue is fixed in Safari 17.4, iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVSS 3.1 · 8.1 High EPSS 1.5% KEV · Not listed

Vendors

Apple Fedoraproject Redhat and 2 more

Products

Ipad Os Ipados Iphone Os and 10 more

CVE-2024-23254

webkit: malicious website may exfiltrate audio data cross-origin

The issue was addressed with improved UI handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. A malicious website may exfiltrate audio data cross-origin.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Fedoraproject Redhat and 2 more

Products

Ipad Os Iphone Os Macos and 9 more

CVE-2024-23213

webkitgtk: Processing web content may lead to arbitrary code execution

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. Processing web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 4 more

CVE-2025-24208

webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Safari and 6 more

CVE-2024-40866

webkitgtk: Visiting a malicious website may lead to address bar spoofing

The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Macos Safari Enterprise Linux and 1 more

CVE-2023-43010

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ios And Ipados Ipados Iphone Os and 8 more