WebKitGTK and WPE WebKit Security Advisory WSA-2020-0004

Overview :
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).

CVE-2020-11793

WebKitGTK and WPE WebKit Security Advisory WSA-2020-0004

  • Date Reported: April 16, 2020
  • Advisory ID: WSA-2020-0004
  • CVE identifiers: CVE-2020-11793.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

  • CVE-2020-11793
    • Versions affected: WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1.
    • Credit to Cim Stordal of Cognite.
    • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or application crash (denial of service). Description: A memory corruption issue (use-after-free) was addressed with improved memory handling.

We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.

Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/.

 

 

WebKitGTK and WPE WebKit Security Advisory WSA-2020-0004

  • Date Reported: April 16, 2020
  • Advisory ID: WSA-2020-0004
  • CVE identifiers: CVE-2020-11793.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

  • CVE-2020-11793
    • Versions affected: WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1.
    • Credit to Cim Stordal of Cognite.
    • Impact: Processing maliciously crafted web content may lead to arbitrary code execution or application crash (denial of service). Description: A memory corruption issue (use-after-free) was addressed with improved memory handling.

We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.

Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/.

Common Vulnerabilityies and Exposures

Internet Download Manager 6.37.11.1 Export/Import stack-based overflow

A vulnerability, which was classified as critical, was found in Internet Download Manager 6.37.11.1. This affects an unknown code block of the component Export/Import. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Passcovery ZIP Password Recovery 3.70.69.0 Decompression buffer overflow

A vulnerability classified as critical was found in Passcovery ZIP Password Recovery 3.70.69.0. Affected by this vulnerability is an unknown part of the component Decompression. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Portable Playable 9.18 JPEG File filename unrestricted upload

A vulnerability, which was classified as critical, has been found in Portable Playable 9.18. Affected by this issue is an unknown code of the component JPEG File Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.