Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-40794 EUVD-2024-38635GHSA-vcmx-3577-7jh3

This issue was addressed through improved state management. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6…

Published Jul 29, 2024 · Updated Apr 2, 2026 · Assigned by apple

Vendor: Apple Product: iOS and iPadOS Product: macOS Product: Safari Package: qtwebkit-opensource-src Package: qtwebkit-source Package: webkit2gtk Package: webkit2gtk Package: webkitgtk Package: wpewebkit Package: wpewebkit Platform: iOS Platform: macOS Category: Browsers Ecosystem: Debian Ecosystem: Ubuntu

Description

This issue was addressed through improved state management. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Private Browsing tabs may be accessed without authentication.

Affected products

VendorProductAffectedFixed
Apple Safari < 17.6 17.6
Apple iOS and iPadOS < 17.6 17.6
Apple macOS < 14.6 14.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 wpewebkit +1 2.44.3-1 —
Debian 13 wpewebkit +1 2.44.3-1 —
Debian 12 webkit2gtk 2.44.3-1~deb12u1 DSA-5762-1
Debian 12 wpewebkit No fix yet —
Debian 11 webkit2gtk 2.44.3-1~deb11u1 DLA-3864-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS qtwebkit-opensource-src No fix yet —
Ubuntu 22.04 LTS wpewebkit +1 No fix yet —
Ubuntu 20.04 LTS wpewebkit +2 No fix yet —
Ubuntu 18.04 LTS webkitgtk +3 No fix yet —
Ubuntu 16.04 LTS webkitgtk +3 No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 webkit2gtk3 +2 2.44.3-150600.12.9.1 SUSE-SU-2024:3109-1
SLES 15 SP5 webkit2gtk3 +2 2.44.3-150400.4.88.1 SUSE-SU-2024:3091-1
SLES 15 SP4 webkit2gtk3 +2 2.44.3-150400.4.88.1 SUSE-SU-2024:3091-1
SLES 15 SP3 webkit2gtk3 2.44.3-150200.118.1 SUSE-SU-2024:3052-1
SLES 15 SP2 webkit2gtk3 2.44.3-150200.118.1 SUSE-SU-2024:3052-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 webkit2gtk3 2.44.3-4.12.1 SUSE-SU-2024:3005-1
SLES for SAP 15 SP4 webkit2gtk3 +2 2.44.3-150400.4.88.1 SUSE-SU-2024:3091-1
SLES for SAP 15 SP3 webkit2gtk3 2.44.3-150200.118.1 SUSE-SU-2024:3052-1
SLES for SAP 15 SP2 webkit2gtk3 2.44.3-150200.118.1 SUSE-SU-2024:3052-1
SLES for SAP 12 SP5 webkit2gtk3 2.44.3-4.12.1 SUSE-SU-2024:3005-1
SLE HPC 15 SP4 webkit2gtk3 +2 2.44.3-150400.4.88.1 SUSE-SU-2024:3091-1
SLE HPC 15 SP3 webkit2gtk3 2.44.3-150200.118.1 SUSE-SU-2024:3052-1
SLE HPC 15 SP2 webkit2gtk3 2.44.3-150200.118.1 SUSE-SU-2024:3052-1
SUSE Manager Server 4.3 webkit2gtk3-soup2 2.44.3-150400.4.88.1 SUSE-SU-2024:3091-1
SUSE Manager Proxy 4.3 webkit2gtk3-soup2 2.44.3-150400.4.88.1 SUSE-SU-2024:3091-1
SUSE Enterprise Storage 7.1 webkit2gtk3 2.44.3-150200.118.1 SUSE-SU-2024:3052-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 webkit2gtk3 +2 2.44.3-150600.12.9.1 SUSE-SU-2024:3109-1
openSUSE Leap 15.5 webkit2gtk3 +2 2.44.3-150400.4.88.1 SUSE-SU-2024:3091-1

Advisories 11

References