GCVE - cpe:2.3:a:webkit:webkit:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:webkit:webkit:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Webkit (`6e576ba3-891d-5770-b179-2f93ba678046`)
Product	Webkit (`57cbf4bc-de9b-50c0-96f2-cda85e1c322b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/webkit/webkit`	purl2cpe	2026-06-01 10:12:24.867121
`pkg:webkit/webkit`	purl2cpe	2026-06-01 10:12:24.867124

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-39928`	vulnerable	2026-06-08 06:09:38.116498	Details available HIGH (8.8) A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability. Published: 2023-10-06T15:17:20.078Z Updated: 2025-11-04T19:17:45.371Z Open on db.gcve.eu Reference links https://talosintelligence.com/vulnerability_reports/TALOS-2023-1831 https://webkitgtk.org/security/WSA-2023-0009.html https://www.debian.org/security/2023/dsa-5527 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/ https://security.gentoo.org/glsa/202401-33	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1766`	vulnerable	2026-06-08 04:54:10.268254	Details available Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in Qt and other products, allows remote websockets servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an upgrade header that is long and invalid. Published: 2010-07-22T01:00:00.000Z Updated: 2024-08-07T01:35:53.654Z Open on db.gcve.eu Reference links http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 http://www.vupen.com/english/advisories/2010/2722 http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044031.html http://secunia.com/advisories/43068 http://www.vupen.com/english/advisories/2010/1801	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-3933`	vulnerable	2026-06-08 04:51:45.350980	Details available WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service (CPU consumption) via a web page that calls the JavaScript setInterval method, which triggers an incompatibility between the WTF::currentTime and base::Time functions. Published: 2009-11-12T16:00:00.000Z Updated: 2024-08-07T06:45:50.882Z Open on db.gcve.eu Reference links http://secunia.com/advisories/43068 http://googlechromereleases.blogspot.com/2009/11/stable-channel-update.html http://www.vupen.com/english/advisories/2011/0212 http://trac.webkit.org/changeset/50173 https://bugs.webkit.org/show_bug.cgi?id=30833	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-6059`	vulnerable	2026-06-08 04:50:53.918251	Details available xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism. Published: 2009-02-05T00:00:00.000Z Updated: 2024-08-07T11:20:23.927Z Open on db.gcve.eu Reference links https://bugs.webkit.org/show_bug.cgi?id=10957 http://trac.webkit.org/changeset/38566/trunk/WebCore/xml/XMLHttpRequest.cpp http://www.securityfocus.com/bid/33804 https://exchange.xforce.ibmcloud.com/vulnerabilities/48575	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.