CVE-2020-11793

HIGH

WebKitGTK and WPE WebKit < 2.28.1 - Use-After-Free via Crafted Web Content

Title source: llm

Description

A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).

References (8)

Core 8

Core References

Vendor Advisory x_refsource_confirm

https://webkitgtk.org/security/WSA-2020-0004.html

Vendor Advisory x_refsource_confirm

https://wpewebkit.org/security/WSA-2020-0004.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3P4YISPE5QX4YD54GDRZIH2X5RCH3QGW/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTKY2MWP6PB6TE3ZKOOMKX7HZUCQNYF6/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3MQTRC6ITFTVS5R5Z24PMJS6FXJKGRD/

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4331-1/

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.html

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/202006-08

Scores

CVSS v3 8.8

EPSS 0.0060

EPSS Percentile 69.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-416

Status published

Products (8)

canonical/ubuntu_linux 18.04

canonical/ubuntu_linux 19.10

fedoraproject/fedora 30

fedoraproject/fedora 31

fedoraproject/fedora 32

opensuse/leap 15.1

webkitgtk/webkitgtk < 2.28.1

wpewebkit/wpe_webkit < 2.28.1

Published Apr 17, 2020

Tracked Since Feb 18, 2026