Description
The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products does not verify whether DNS prefetching is enabled when processing an HTML LINK element, which allows remote attackers to bypass intended access restrictions, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qtwebkit-source | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | webkitgtk +2 | 1.2.6-2.el6_0 | RHSA-2011:0177 |
Advisories 1
- RHSA-2011:0177 Red Hat Security Advisory: webkitgtk security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- MDVSA-2011:039 vendor-advisory
- FEDORA-2011-0121 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=667024
- 43068 third-party-advisory
- http://trac.webkit.org/changeset/63622
- http://support.apple.com/kb/HT4455
- ADV-2011-0212 vdb-entry
- ADV-2010-3046 vdb-entry
- ADV-2011-0216 vdb-entry
- oval:org.mitre.oval:def:12293 vdb-entry signature
- 43086 third-party-advisory
- SUSE-SR:2011:002 vendor-advisory
- APPLE-SA-2010-11-18-1 vendor-advisory
- 42314 third-party-advisory
- RHSA-2011:0177 vendor-advisory
- ADV-2011-0552 vdb-entry
- http://support.apple.com/kb/HT4456
- https://bugs.webkit.org/show_bug.cgi?id=42500
- APPLE-SA-2010-11-22-1 vendor-advisory