Vulnerability Name:

CVE-2020-13558 (CCN-196795)

Assigned:2020-05-26
Published:2021-02-15
Updated:2022-07-30
Summary:A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-416
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2020-13558

Source: XF
Type: UNKNOWN
webkit-cve202013558-code-exec(196795)

Source: CCN
Type: oss-sec Mailing List, Mon, 15 Feb 2021 16:26:27 +0100
WebKitGTK and WPE WebKit Security Advisory WSA-2021-0001

Source: GENTOO
Type: Third Party Advisory
GLSA-202104-03

Source: MISC
Type: Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1172

Source: CCN
Type: WSA-2021-0001
WebKitGTK and WPE WebKit Security Advisory WSA-2021-0001

Source: CCN
Type: IBM Security Bulletin 6551876 (Cloud Pak for Security)
Cloud Pak for Security uses packages that are vulnerable to multiple CVEs

Vulnerable Configuration:Configuration 1:
  • cpe:/a:webkitgtk:webkitgtk:2.30.1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:webkitgtk:webkitgtk:2.30.4:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8033
    P
    		libjavascriptcoregtk-5_0-0-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:7603
    P
    		libjavascriptcoregtk-4_0-18-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7941
    P
    		libjavascriptcoregtk-4_1-0-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:93155
    P
    		 (Important)
    2022-07-12
    oval:org.opensuse.security:def:93308
    P
    		 (Important)
    2022-07-06
    oval:org.opensuse.security:def:3401
    P
    		xen-4.12.1_06-1.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3018
    P
    		augeas-1.10.1-2.6 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3562
    P
    		libXp6-1.0.2-3.57 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3320
    P
    		pam_yubico-2.26-1.25 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94824
    P
    		rzsz-0.12.21~rc-1.8 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95031
    P
    		libjavascriptcoregtk-5_0-0-2.36.0-150400.2.12 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94648
    P
    		libjavascriptcoregtk-4_0-18-2.36.0-150400.2.13 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94674
    P
    		libopenjp2-7-2.3.0-150000.3.5.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94950
    P
    		libjavascriptcoregtk-4_1-0-2.36.0-150400.2.13 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:144
    P
    		libjavascriptcoregtk-4_0-18-2.32.0-3.15.1 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:1073
    P
    		Security update for tiff (Important)
    2022-05-30
    oval:org.opensuse.security:def:99200
    P
    		 (Moderate)
    2022-01-20
    oval:org.opensuse.security:def:112660
    P
    		libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:1744
    P
    		Security update for the Linux Kernel (Important)
    2021-11-16
    oval:org.opensuse.security:def:101537
    P
    		Security update for binutils (Moderate)
    2021-11-09
    oval:com.redhat.rhsa:def:20214381
    P
    		RHSA-2021:4381: GNOME security, bug fix, and enhancement update (Moderate)
    2021-11-09
    oval:org.opensuse.security:def:106141
    P
    		libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:102207
    P
    		Security update for apache2-mod_auth_openidc (Moderate)
    2021-09-13
    oval:org.opensuse.security:def:101387
    P
    		openssh-fips-8.4p1-1.30 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62833
    P
    		typelib-1_0-JavaScriptCore-4_0-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101239
    P
    		typelib-1_0-JavaScriptCore-4_0-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72552
    P
    		typelib-1_0-JavaScriptCore-4_0-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62162
    P
    		libjavascriptcoregtk-4_0-18-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100920
    P
    		libjavascriptcoregtk-4_0-18-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:71903
    P
    		libjavascriptcoregtk-4_0-18-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:99395
    P
    		 (Important)
    2021-07-14
    oval:org.opensuse.security:def:34468
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:89410
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:30213
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:57465
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:85666
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:32949
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:59755
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:88144
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:26076
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:55916
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:83420
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:125558
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:31202
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:57944
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:86106
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:51589
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:5063
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:33674
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:60291
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:88457
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:29385
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:56036
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:84164
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:126728
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:31642
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:58772
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:86585
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:23601
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:51913
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:82592
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:33932
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:89152
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:30093
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:57025
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:84622
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:127125
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:32121
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:59497
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:87413
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:23925
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:55208
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:83300
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:111249
    P
    		Security update for webkit2gtk3 (Important)
    2021-03-03
    oval:org.opensuse.security:def:9844
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92445
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:69590
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:99594
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:9089
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:70535
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:99005
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:97234
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:10204
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92644
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:69785
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:99793
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:9450
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92055
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:10395
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92843
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:8703
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:69984
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:100105
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:9645
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92250
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:93002
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:8894
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:70344
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-24
    oval:org.opensuse.security:def:108203
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:76103
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:97228
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:4179
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:64651
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:108873
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:95494
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:5946
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:73773
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:65268
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:117567
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:108053
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:74336
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:67035
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    oval:org.opensuse.security:def:117717
    P
    		Security update for webkit2gtk3 (Important)
    2021-02-22
    BACK
    webkitgtk webkitgtk 2.30.1
    webkitgtk webkitgtk 2.30.4
    ibm cloud pak for security 1.7.2.0