PT-2020-1836 · Apple+7 · Wpe Webkit+8

Ashfaq Ansari + 2 · Published 2020-03-02 · Updated 2024-06-15 · CVE-2020-10018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebKitGTK versions prior to 2.28.0 WPE WebKit versions prior to 2.28.0

Description The issue is related to a memory corruption problem, specifically a use-after-free error, which may lead to arbitrary code execution. This can be exploited by a remote attacker to execute arbitrary code.

Recommendations For WebKitGTK versions prior to 2.28.0, update to version 2.28.0 or later, which includes improved memory handling to fix the issue. For WPE WebKit versions prior to 2.28.0, update to version 2.28.0 or later, which includes improved memory handling to fix the issue.

Fix

Use After Free

RCE

Weakness Enumeration

CWE-416

CWE-20

Related Identifiers

ALSA-2020:4451

ALT-PU-2020-1481

BDU:2020-01109

CESA-2020_4035

CESA-2020_4451

CVE-2020-10018

DSA-4641-1

MGASA-2020-0144

OPENSUSE-SU-2020:0602-1

OPENSUSE-SU-2020_0602-1

OPENSUSE-SU-2024:11506-1

RHSA-2020:4035

RHSA-2020:4451

RHSA-2020_4035

RHSA-2020_4451

RLSA-2020:4451

SUSE-SU-2020:1109-1

SUSE-SU-2020:1135-1

SUSE-SU-2020_1109-1

SUSE-SU-2022:0142-1

SUSE-SU-2022:0183-1

USN-4310-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Rocky Linux

Suse

Ubuntu

Wpe Webkit

Webkitgtk

References · 401

• https://linux.oracle.com/errata/ELSA-2020-4035.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10018 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6K · Vendor Advisory
• https://debian.org/security/2020/dsa-4641 · Vendor Advisory
• https://wpewebkit.org/security/WSA-2020-0003.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4451 · Vendor Advisory
• https://webkitgtk.org/security/WSA-2020-0003.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4641-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202006-08 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10018 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0144.html · Security Note
• https://osv.dev/vulnerability/USN-4310-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10018 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0602-1 · Vendor Advisory
• https://bugs.webkit.org/show_bug.cgi?id=204342#c21 · Vendor Advisory