CVE-2019-8720highunder attackCWE-119

CVE-2019-8720: high-severity vulnerability in webkitgtk

Published · Updated

Follow this CVE+ Monitor WebKitGTK+ Monitor webkit2gtk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 1.6%
from disclosure to weapon
Published on NVDMar 6
CISA KEVMay 23
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (9 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
workaround: Red Hat has investigated whether possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Fixed
9 products (342 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · and others 4
fix ↗
Not affected
3 products (1,148 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat CodeReady Linux Builder (v. 8) · Red Hat Enterprise Linux BaseOS (v. 8)
Action required by CISAfederal deadline: 2022-06-13

Apply updates per vendor instructions.

In short

WebKit contains a memory corruption vulnerability triggered by malicious web content that could allow attackers to run arbitrary code on your device. Visiting a compromised website could be enough to exploit this flaw.

Technical detail

CWE-119 (Buffer Overflow) in WebKit's memory handling allows remote code execution via crafted web content. The attack requires user interaction (visiting a malicious website) and results in arbitrary code execution with the privileges of the WebKit process. Multiple memory corruption issues are addressed through improved memory management.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · webkitgtk