CVE-2020-10018

CWE-416 — Use After FreeCWE-400 — Uncontrolled Resource ConsumptionCWE-20 — Improper Input Validation9 documents8 sources
Severity
9.8CRITICAL
EPSS
2.6%
top 14.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Webkitgtk WebkitgtkWpewebkit WPE WebkitCanonical Ubuntu Linux+3 more
Timeline
PublishedMar 2
Latest updateMay 24

Description

WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶NVDwebkitgtk/webkitgtk< 2.28.0
▶NVDwpewebkit/wpe_webkit< 2.28.0
▶Debianwpewebkit< 2.28.0-1+3
▶Debianwebkit2gtk< 2.28.0-2+3
▶NVDopensuse/leap15.1

Also affects: Debian Linux 10.0, Fedora 30, 31, Ubuntu Linux 18.04, 19.10

🔴Vulnerability Details

3
GHSA
GHSA-37vm-m2gx-6h3h: accessibility/AXObjectCache↗2022-05-24
▶
CVEList
CVE-2020-10018: WebKitGTK through 2↗2020-03-02
▶
OSV
CVE-2020-10018: WebKitGTK through 2↗2020-03-02
▶

📋Vendor Advisories

3
Ubuntu
WebKitGTK+ vulnerability↗2020-03-30
▶
Red Hat
webkitgtk: Use-after-free issue in accessibility/AXObjectCache.cpp↗2020-03-02
▶
Debian
CVE-2020-10018: webkit2gtk - WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions r...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-10018 webkit2gtk3: webkitgtk: Denial of service issue in accessibility/AXObjectCache.cpp [fedora-all]↗2020-03-09
▶
Bugzilla
CVE-2020-10018 webkitgtk: Use-after-free issue in accessibility/AXObjectCache.cpp↗2020-03-09
▶