Vulnerability Details : CVE-2019-11070
WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.
Products affected by CVE-2019-11070
- cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
- cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-11070
2.00%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-11070
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2019-11070
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-11070
-
http://www.openwall.com/lists/oss-security/2019/04/11/1
oss-security - WebKitGTK and WPE WebKit Security Advisory WSA-2019-0002Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html
[security-announce] openSUSE-SU-2019:1391-1: important: Security update
-
https://usn.ubuntu.com/3948-1/
USN-3948-1: WebKitGTK+ vulnerabilities | Ubuntu security notices
-
https://bugs.webkit.org/show_bug.cgi?id=193718
193718 – (CVE-2019-11070) [GStreamer] HLS, DASH, and Smooth Streaming implementations ignore proxy settingsIssue Tracking;Third Party Advisory
-
http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Code-Execution.html
WebKitGTK+ / WPE WebKit URI Spoofing / Code Execution ≈ Packet StormThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html
[security-announce] openSUSE-SU-2019:1374-1: important: Security update
-
https://seclists.org/bugtraq/2019/Apr/21
Bugtraq: WebKitGTK and WPE WebKit Security Advisory WSA-2019-0002Mailing List;Third Party Advisory;VDB Entry
-
https://trac.webkit.org/changeset/243197/webkit
Changeset 243197 – WebKitPatch;Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ/
[SECURITY] Fedora 30 Update: webkit2gtk3-2.24.1-1.fc30 - package-announce - Fedora Mailing-Lists
-
https://security.gentoo.org/glsa/201909-05
WebkitGTK+: Multiple vulnerabilities (GLSA 201909-05) — Gentoo security
Jump to