CVE-2019-6251

Name	CVE-2019-6251
Description	WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
webkit2gtk (PTS)	jessie	2.6.2+dfsg1-4	vulnerable
	stretch	2.18.6-1~deb9u1	vulnerable
	buster	2.24.1-2	fixed
	sid	2.24.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
webkit2gtk	source	(unstable)	2.24.1-1	medium

Notes

[stretch] - webkit2gtk <ignored> (Not covered by security support in stretch)
[jessie] - webkit2gtk <ignored> (Not covered by security support in jessie)
https://gitlab.gnome.org/GNOME/epiphany/issues/532
https://bugs.webkit.org/show_bug.cgi?id=194131
https://bugs.webkit.org/show_bug.cgi?id=194208
https://webkitgtk.org/security/WSA-2019-0002.html