CVE-2020-13558: Use After Free
A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free.
Other sources
A flaw was found in WebKitGTK.
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue in the AudioSourceProviderGStreamer class was addressed with improved memory management.
Reference: https://webkitgtk.org/security/WSA-2021-0001.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/webkitgtkto a version that resolves this vulnerability.Fixed in 2.30.5
Event History
Frequently Asked Questions
What is the vulnerability ID of this code execution vulnerability?
The vulnerability ID of this code execution vulnerability is CVE-2020-13558.
In which software does the vulnerability CVE-2020-13558 exist?
The vulnerability CVE-2020-13558 exists in WebKitGTK 2.30.1.
What is the severity of vulnerability CVE-2020-13558?
The severity of vulnerability CVE-2020-13558 is high with a CVSS score of 8.8.
What is the CWE ID associated with vulnerability CVE-2020-13558?
The CWE ID associated with vulnerability CVE-2020-13558 is CWE-416.
How can I fix vulnerability CVE-2020-13558?
To fix vulnerability CVE-2020-13558, it is recommended to update WebKitGTK to a version that includes the necessary patch or apply the patch provided by the vendor.