by Kastro
Paper/Archive/CVE-2020-10018

CVE-2020-10018

mitre — WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (u…

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.2.922 × 2018.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugs.webkit.org/show_bug.cgi?id=204342#c21refwebkitgtk.org/security/WSA-2020-0003.htmlrefwpewebkit.org/security/WSA-2020-0003.htmladvisorydebian.org/security/2020/dsa-4641advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLERWAS2LL7SX2GHA2DDZ2PL3QC5OHIFadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6Kadvisoryusn.ubuntu.com/4310-1advisorylists.opensuse.org/opensuse-security-announce/2020-05/msg00008.htmladvisorysecurity.gentoo.org/glsa/202006-08