CVE-2020-11793
published 2020-04-17CVE-2020-11793: A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary…
PriorityP342high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
2.83%
84.9th percentile
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | webkit2gtk | < webkit2gtk 2.28.1-1 (bookworm) | webkit2gtk 2.28.1-1 (bookworm) |
| debian | wpewebkit | < webkit2gtk 2.28.1-1 (bookworm) | webkit2gtk 2.28.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
| webkitgtk | webkitgtk | < 2.28.1 | 2.28.1 |
| wpewebkit | wpe_webkit | < 2.28.1 | 2.28.1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
WebKitGTK+ vulnerability
vendor_ubuntu·2020-04-20
CVE-2020-11793 WebKitGTK+ vulnerability
Title: WebKitGTK+ vulnerability
Summary: Several security issues were fixed in WebKitGTK+.
A large number of security issues were discovered in the WebKitGTK+ Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
Red Hat
webkitgtk: use-after-free via crafted web content
vendor_redhat·2020-04-16·CVSS 8.8
CVE-2020-11793 [HIGH] CWE-416 webkitgtk: use-after-free via crafted web content
webkitgtk: use-after-free via crafted web content
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).
A use-after-free flaw exists in WebKitGTK. This flaw allows remote attackers to execute arbitrary code or cause a denial of service.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Out of support scope
Package: webkitgtk3 (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2020-11793: webkit2gtk - A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2...
vendor_debian·2020·CVSS 8.8
CVE-2020-11793 [HIGH] CVE-2020-11793: webkit2gtk - A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2...
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).
Scope: local
bookworm: resolved (fixed in 2.28.1-1)
bullseye: resolved (fixed in 2.28.1-1)
forky: resolved (fixed in 2.28.1-1)
sid: resolved (fixed in 2.28.1-1)
trixie: resolved (fixed in 2.28.1-1)
GHSA
GHSA-9rmm-vmrf-4wgf: A use-after-free issue exists in WebKitGTK before 2
ghsa_unreviewed·2022-05-24
CVE-2020-11793 [HIGH] GHSA-9rmm-vmrf-4wgf: A use-after-free issue exists in WebKitGTK before 2
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).
OSV
CVE-2020-11793: A use-after-free issue exists in WebKitGTK before 2
osv·2020-04-17·CVSS 8.8
CVE-2020-11793 [HIGH] CVE-2020-11793: A use-after-free issue exists in WebKitGTK before 2
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3P4YISPE5QX4YD54GDRZIH2X5RCH3QGW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3MQTRC6ITFTVS5R5Z24PMJS6FXJKGRD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTKY2MWP6PB6TE3ZKOOMKX7HZUCQNYF6/https://security.gentoo.org/glsa/202006-08https://usn.ubuntu.com/4331-1/https://webkitgtk.org/security/WSA-2020-0004.htmlhttps://wpewebkit.org/security/WSA-2020-0004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3P4YISPE5QX4YD54GDRZIH2X5RCH3QGW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3MQTRC6ITFTVS5R5Z24PMJS6FXJKGRD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTKY2MWP6PB6TE3ZKOOMKX7HZUCQNYF6/https://security.gentoo.org/glsa/202006-08https://usn.ubuntu.com/4331-1/https://webkitgtk.org/security/WSA-2020-0004.htmlhttps://wpewebkit.org/security/WSA-2020-0004.html
2020-04-17
Published