CVE-2019-11070 Information disclosure in n/a

Medium 5.3 Published 10 Apr 2019 Updated 4 Aug 2024

Attackers can deanonymize users by bypassing HTTP proxy settings during livestream video downloads in WebKitGTK and WPE WebKit.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-11070?

CVE-2019-11070 is a medium-severity vulnerability in Webkitgtk Webkitgtk, published on 10 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.

Weakness: CWE-19

Which versions are affected by CVE-2019-11070?

It affects 2 products.

Products include Webkitgtk Webkitgtk, Wpewebkit Wpe Webkit.

How do I fix CVE-2019-11070?

Upgrade to a fixed version.

Is CVE-2019-11070 being exploited?

There is no known exploitation of CVE-2019-11070 in the wild and no public exploit code.

All Webkitgtk Webkitgtk vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-11070, GHSA-jcch-9vxr-f9mg, UBUNTU-CVE-2019-11070.