Vulnerability Name:

CVE-2020-13584 (CCN-192463)

Assigned:2020-11-23
Published:2020-11-23
Updated:2022-08-06
Summary:An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-416
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2020-13584

Source: XF
Type: UNKNOWN
webkit-cve202013584-code-exec(192463)

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-e8a7566e80

Source: GENTOO
Type: Third Party Advisory
GLSA-202012-10

Source: CCN
Type: Talos Vulnerability Report TALOS-2020-1195
Webkit ImageDecoderGStreamer use-after-free vulnerability

Source: MISC
Type: Exploit, Technical Description, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1195

Source: CCN
Type: WebKitGTK Web site
WebKit

Source: CCN
Type: IBM Security Bulletin 6493729 (Cloud Pak for Security)
Cloud Pak for Security is vulnerable to several CVEs

Source: CCN
Type: IBM Security Bulletin 6520474 (QRadar SIEM)
IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities

Vulnerable Configuration:Configuration 1:
  • cpe:/a:webkitgtk:webkitgtk:2.30.1:*:*:*:*:*:x64:*

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:32:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:webkitgtk:webkitgtk:2.30.1:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8033
    P
    		libjavascriptcoregtk-5_0-0-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:7603
    P
    		libjavascriptcoregtk-4_0-18-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7941
    P
    		libjavascriptcoregtk-4_1-0-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3320
    P
    		pam_yubico-2.26-1.25 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3361
    P
    		sane-backends-1.0.24-3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3401
    P
    		xen-4.12.1_06-1.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3018
    P
    		augeas-1.10.1-2.6 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3190
    P
    		libjansson4-2.12-3.5.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94757
    P
    		mutt-1.10.1-150000.3.23.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95031
    P
    		libjavascriptcoregtk-5_0-0-2.36.0-150400.2.12 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95161
    P
    		sysstat-isag-12.0.2-3.33.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94648
    P
    		libjavascriptcoregtk-4_0-18-2.36.0-150400.2.13 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94950
    P
    		libjavascriptcoregtk-4_1-0-2.36.0-150400.2.13 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:144
    P
    		libjavascriptcoregtk-4_0-18-2.32.0-3.15.1 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:1073
    P
    		Security update for tiff (Important)
    2022-05-30
    oval:org.opensuse.security:def:94473
    P
    		 (Important)
    2022-02-04
    oval:org.opensuse.security:def:112660
    P
    		libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:5337
    P
    		Security update for net-snmp (Important)
    2022-01-05
    oval:org.opensuse.security:def:1744
    P
    		Security update for the Linux Kernel (Important)
    2021-11-16
    oval:org.opensuse.security:def:106141
    P
    		libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:96759
    P
    		python3-pyOpenSSL-17.5.0-3.3.2 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:96761
    P
    		python3-requests-2.20.0-4.24 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:101874
    P
    		Security update for the Linux Kernel (Important)
    2021-08-14
    oval:org.opensuse.security:def:62162
    P
    		libjavascriptcoregtk-4_0-18-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101186
    P
    		libcolord-gtk-devel-0.1.26-1.48 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101239
    P
    		typelib-1_0-JavaScriptCore-4_0-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62833
    P
    		typelib-1_0-JavaScriptCore-4_0-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:71903
    P
    		libjavascriptcoregtk-4_0-18-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72552
    P
    		typelib-1_0-JavaScriptCore-4_0-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100920
    P
    		libjavascriptcoregtk-4_0-18-2.32.0-3.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101470
    P
    		Security update for dbus-1 (Important)
    2021-07-12
    oval:org.opensuse.security:def:32121
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:58772
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:89410
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:23925
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:51913
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:85666
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:34468
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:30213
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:57025
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:88144
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:83420
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:32949
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:59497
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:26076
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:55208
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:86106
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:125558
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:31202
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:57465
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:88457
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:84164
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:5063
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:33674
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:59755
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:29385
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:55916
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:86585
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:82592
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:126728
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:31642
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:57944
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:89152
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:23601
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:51589
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:84622
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:33932
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:60291
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:30093
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:56036
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:87413
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:83300
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:org.opensuse.security:def:127125
    P
    		Security update for webkit2gtk3 (Important)
    2021-06-17
    oval:com.redhat.rhsa:def:20211586
    P
    		RHSA-2021:1586: GNOME security, bug fix, and enhancement update (Moderate)
    2021-05-18
    oval:org.opensuse.security:def:110382
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-21
    oval:org.opensuse.security:def:110922
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-21
    oval:org.opensuse.security:def:104083
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:73401
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:117650
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:66702
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:108136
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:75494
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:10032
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:90594
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:65139
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:97393
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:104249
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:73572
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:5613
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:69418
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:108540
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:75770
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:91133
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:4050
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:65201
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:97559
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:104788
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:74207
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:8533
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:70172
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:64279
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:117367
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:4112
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:66426
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:98098
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:107852
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:74269
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:9278
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:90428
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:64450
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    BACK
    webkitgtk webkitgtk 2.30.1
    fedoraproject fedora 32
    webkitgtk webkitgtk 2.30.1
    ibm qradar security information and event manager 7.3
    ibm qradar security information and event manager 7.4 -
    ibm cloud pak for security 1.7.0.0
    ibm cloud pak for security 1.7.1.0
    ibm cloud pak for security 1.7.2.0