CVE-2019-8720KEV ยท OVERDUECWE-119

WebKitGTK Memory Corruption Vulnerability

High ยท published March 7, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 75.0th percentile for exploit probability.

1593
days past CISA
deadline
CVSS v3.1
8.8
EPSS
2%
Percentile
75.0
In the wild
Confirmed
What it is

๐Ÿšจ A crafty web content flaw in WebKit can lead to arbitrary code execution, and it's already been exploited! ๐Ÿ”ฅ Think of it like a restaurant that accepts any dish order without checking the recipe โ€” if someone sneaks in a dangerous ingredient, it can ruin everything! In this case, malicious web content is that sneaky ingredient. An attacker could harness this vulnerability to run arbitrary code on your system, potentially taking control of your device or stealing sensitive information. The consequences could be absolutely devastating if left unaddressed, as they can compromise your entire browser experience.

Put simply

Think of it like a restaurant that accepts any dish order without checking the recipe โ€” if someone sneaks in a dangerous ingredient, it can ruin everything! In this case, malicious web content is that sneaky ingredient. This vulnerability in WebKit arises from improper memory handling when processing crafted web content, leading to multiple memory corruption issues. Essentially, it allows hackers to execute code remotely, bypassing security measures.

What to do

An attacker could harness this vulnerability to run arbitrary code on your system, potentially taking control of your device or stealing sensitive information. The consequences could be absolutely devastating if left unaddressed, as they can compromise your entire browser experience. Immediately update your WebKit to the latest secure version to patch this vulnerability, and educate users to avoid suspicious links. Regular security audits can also help identify potential weaknesses in your browser settings. You've got this! Following these steps will keep your data secure and your browsing safe. ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
8.8 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01556 ยท 75.0th percentile
Weakness
CWE-119 ยท Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2023-03-07T04:15Z
KEV added
2022-05-23 ยท due 2022-06-13
Affected products (41)
ProductVersionsFixed in
webkitgtk/webkitgtk< 2.26.02.26.0
wpewebkit/wpe_webkit< 2.26.02.26.0
redhat/codeready_linux_builderall versionsโ€”
redhat/codeready_linux_builder_eusall versionsโ€”
redhat/codeready_linux_builder_eusall versionsโ€”
redhat/codeready_linux_builder_for_arm64_eusall versionsโ€”
redhat/codeready_linux_builder_for_arm64_eusall versionsโ€”
redhat/codeready_linux_builder_for_arm64_eusall versionsโ€”
redhat/codeready_linux_builder_for_ibm_z_systems_eusall versionsโ€”
redhat/codeready_linux_builder_for_ibm_z_systems_eusall versionsโ€”
redhat/codeready_linux_builder_for_ibm_z_systems_eusall versionsโ€”
redhat/codeready_linux_builder_for_power_little_endian_eusall versionsโ€”
redhat/codeready_linux_builder_for_power_little_endian_eusall versionsโ€”
redhat/codeready_linux_builder_for_power_little_endian_eusall versionsโ€”
redhat/enterprise_linuxall versionsโ€”
redhat/enterprise_linux_desktopall versionsโ€”
redhat/enterprise_linux_eusall versionsโ€”
redhat/enterprise_linux_eusall versionsโ€”
redhat/enterprise_linux_eusall versionsโ€”
redhat/enterprise_linux_eusall versionsโ€”
redhat/enterprise_linux_for_arm64_eusall versionsโ€”
redhat/enterprise_linux_for_ibm_z_systemsall versionsโ€”
redhat/enterprise_linux_for_ibm_z_systemsall versionsโ€”
redhat/enterprise_linux_for_ibm_z_systems_eusall versionsโ€”
redhat/enterprise_linux_for_ibm_z_systems_eusall versionsโ€”
redhat/enterprise_linux_for_power_big_endianall versionsโ€”
redhat/enterprise_linux_for_power_little_endianall versionsโ€”
redhat/enterprise_linux_for_power_little_endianall versionsโ€”
redhat/enterprise_linux_for_power_little_endian_eusall versionsโ€”
redhat/enterprise_linux_for_power_little_endian_eusall versionsโ€”
redhat/enterprise_linux_for_scientific_computingall versionsโ€”
redhat/enterprise_linux_serverall versionsโ€”
redhat/enterprise_linux_server_ausall versionsโ€”
redhat/enterprise_linux_server_ausall versionsโ€”
redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsall versionsโ€”
redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsall versionsโ€”
redhat/enterprise_linux_server_tusall versionsโ€”
redhat/enterprise_linux_server_tusall versionsโ€”
redhat/enterprise_linux_server_update_services_for_sap_solutionsall versionsโ€”
redhat/enterprise_linux_server_update_services_for_sap_solutionsall versionsโ€”
redhat/enterprise_linux_workstationall versionsโ€”
References (5)
EPSS history
Timeline
  • 06 MAR 00:00Z
    A vulnerability was found in WebKit
    cvelistv5
  • 23 MAY 00:00Z
    Added to CISA KEV โ€” remediate by Jun 13
    kev