CVE-2018-11646

webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.

• https://bugs.webkit.org/show_bug.cgi?id=186164Issue Tracking, Patch, Vendor Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=795740Exploit, Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/201808-04Third Party Advisory
• https://www.exploit-db.com/exploits/44842/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44876/Exploit, Third Party Advisory, VDB Entry
• https://bugs.webkit.org/show_bug.cgi?id=186164Issue Tracking, Patch, Vendor Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=795740Exploit, Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/201808-04Third Party Advisory
• https://www.exploit-db.com/exploits/44842/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44876/Exploit, Third Party Advisory, VDB Entry

Published

Jun 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1164This vulnerability allows remote attackers to cause a denial…
• CVE-2018-11640XML External Entity (XXE) vulnerability in the web service i…
• CVE-2018-11641Use of Hard-coded Credentials in /var/www/xms/application/co…
• CVE-2018-11642Incorrect Permission Assignment on the /var/www/xms/cleanzip…
• CVE-2018-11643SQL injection vulnerability in the administrative console in…
• CVE-2018-11645psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits th…
• CVE-2018-11647index.js in oauth2orize-fprm before 0.2.1 has XSS via a craf…
• CVE-2018-11649Hue 3.12 has XSS via the /pig/save/ name and script paramete…
• CVE-2018-1165This vulnerability allows local attackers to escalate privil…7
• CVE-2018-11650Graylog before v2.4.4 has an XSS security issue with unescap…
• CVE-2018-11651Graylog before v2.4.4 has an XSS security issue with unescap…
• CVE-2018-11652CSV Injection vulnerability in Nikto 2.1.6 and earlier allow…