High severity · published Mar 6, 2023
CVE-2019-8720
WebKitGTK Memory Corruption Vulnerability
In wildKEV
8.8
CVSS
1.6%
EPSS
Yes
On KEV
Description
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildYes
CISA KEVListed May 23, 2022
Federal remediation dueJun 13, 2022
Ransomware campaign useNot known
Affected products
Which versions
WE
webkitgtk ·
Fixed in webkitgtk 2.26.0 · source: vendor, NVD, KEV
CL
Codeready Linux Builder · Redhat
8.0 · source: NVD
CL
Codeready Linux Builder Eus · Redhat
8.4; 8.6 · source: NVD
CL
Codeready Linux Builder For Arm64 Eus · Redhat
8.0; 8.4; 8.6 · source: NVD
CL
Codeready Linux Builder For Ibm Z Systems Eus · Redhat
8.0; 8.4; 8.6 · source: NVD
CL
Codeready Linux Builder For Power Little Endian Eus · Redhat
8.0; 8.4; 8.6 · source: NVD
EL
Enterprise Linux · Redhat
8.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
8.4; 8.4; 8.6; 8.6 · source: NVD
EL
Enterprise Linux For Arm64 Eus · Redhat
8.6 · source: NVD
EL
Enterprise Linux For Ibm Z Systems · Redhat
7.0; 8.0 · source: NVD
EL
Enterprise Linux For Ibm Z Systems Eus · Redhat
8.4; 8.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-8720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-8720
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1876611
webkitgtk.org
https://webkitgtk.org/security/WSA-2019-0005.html