CVE-2020-10018

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-10018
WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.html Mailing List Third Party Advisory
https://bugs.webkit.org/show_bug.cgi?id=204342#c21 Permissions Required Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6K/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLERWAS2LL7SX2GHA2DDZ2PL3QC5OHIF/
https://security.gentoo.org/glsa/202006-08 Third Party Advisory
https://usn.ubuntu.com/4310-1/ Third Party Advisory
https://webkitgtk.org/security/WSA-2020-0003.html Vendor Advisory
https://wpewebkit.org/security/WSA-2020-0003.html Vendor Advisory
https://www.debian.org/security/2020/dsa-4641 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
History

07 Nov 2023, 03:14

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLERWAS2LL7SX2GHA2DDZ2PL3QC5OHIF/', 'name': 'FEDORA-2020-f3fa778924', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6K/', 'name': 'FEDORA-2020-f25793aac4', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLERWAS2LL7SX2GHA2DDZ2PL3QC5OHIF/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6K/ -

22 Apr 2022, 19:02

Type Values Removed Values Added
References (UBUNTU) https://usn.ubuntu.com/4310-1/ - (UBUNTU) https://usn.ubuntu.com/4310-1/ - Third Party Advisory
References (MISC) https://wpewebkit.org/security/WSA-2020-0003.html - (MISC) https://wpewebkit.org/security/WSA-2020-0003.html - Vendor Advisory
References (DEBIAN) https://www.debian.org/security/2020/dsa-4641 - (DEBIAN) https://www.debian.org/security/2020/dsa-4641 - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLERWAS2LL7SX2GHA2DDZ2PL3QC5OHIF/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLERWAS2LL7SX2GHA2DDZ2PL3QC5OHIF/ - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6K/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6K/ - Mailing List, Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.html - Mailing List, Third Party Advisory
References (MISC) https://bugs.webkit.org/show_bug.cgi?id=204342#c21 - (MISC) https://bugs.webkit.org/show_bug.cgi?id=204342#c21 - Permissions Required, Vendor Advisory
References (MISC) https://webkitgtk.org/security/WSA-2020-0003.html - (MISC) https://webkitgtk.org/security/WSA-2020-0003.html - Vendor Advisory
References (GENTOO) https://security.gentoo.org/glsa/202006-08 - (GENTOO) https://security.gentoo.org/glsa/202006-08 - Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
CVSS v2 : 5.0
v3 : 7.5 		v2 : 7.5
v3 : 9.8
CWE CWE-20 CWE-416
First Time Debian debian Linux
Debian
Opensuse leap
Canonical ubuntu Linux
Fedoraproject fedora
Canonical
Opensuse
Fedoraproject
Information

Published : 2020-03-02 23:15

Updated : 2023-12-10 13:13

NVD link : CVE-2020-10018

Mitre link : CVE-2020-10018

CVE.ORG link : CVE-2020-10018

JSON object : View

Products Affected

webkitgtk

  • webkitgtk

opensuse

  • leap

wpewebkit

  • wpe_webkit

debian

  • debian_linux

canonical

  • ubuntu_linux

fedoraproject

  • fedora
CWE
CWE-416

Use After Free