Vulnerability · Published Dec 3, 2020 · Assigned by talos
CVE-2020-13543
High 8.8
In plain English
A high-severity security flaw in Webkit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)3.5%top 10.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | OpenEXR-devel | 2.2.0-12.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | OpenEXR-libs | 2.2.0-12.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | accountsservice-devel | 0.6.55-1.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | atkmm | 2.24.2-7.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | atkmm-devel | 2.24.2-7.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | atkmm-doc | 2.24.2-7.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | cairomm | 1.12.0-8.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | cairomm-devel | 1.12.0-8.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | cairomm-doc | 1.12.0-8.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | chrome-gnome-shell | 10.1-7.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | dleyna-core | 0.6.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | dleyna-server | 0.6.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | enchant2 | 2.2.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | enchant2-devel | 2.2.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gamin | 0.1.10-32.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gamin-devel | 0.1.10-32.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geoclue2 | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geoclue2-demos | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geoclue2-devel | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geoclue2-libs | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geocode-glib | 3.26.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geocode-glib-devel | 3.26.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gjs | 1.56.2-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gjs-devel | 1.56.2-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glib2-doc | 2.56.4-9.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glib2-static | 2.56.4-9.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glibmm24 | 2.56.0-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glibmm24-devel | 2.56.0-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glibmm24-doc | 2.56.0-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-boxes | 3.36.5-8.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-photos | 3.28.1-4.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-photos-tests | 3.28.1-4.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-terminal | 3.28.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-terminal-nautilus | 3.28.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk-doc | 1.28-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2 | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2-devel | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2-devel-docs | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2-immodule-xim | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2-immodules | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm24 | 2.24.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm24-devel | 2.24.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm24-docs | 2.24.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm30 | 3.22.2-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm30-devel | 3.22.2-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm30-doc | 3.22.2-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-afc | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-afp | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-archive | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-client | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-devel | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-fuse | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-goa | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-gphoto2 | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-mtp | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-smb | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libdazzle | 3.28.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libdazzle-devel | 3.28.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libepubgen | 0.1.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libepubgen-devel | 0.1.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsass | 3.4.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsass-devel | 3.4.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsigc++20 | 2.10.0-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsigc++20-devel | 2.10.0-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsigc++20-doc | 2.10.0-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libvisual | 1:0.4.0-25.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libvisual-devel | 1:0.4.0-25.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | mutter-devel | 3.32.2-57.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | nautilus | 3.28.1-15.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | nautilus-devel | 3.28.1-15.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | nautilus-extensions | 3.28.1-15.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | pangomm | 2.40.1-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | pangomm-devel | 2.40.1-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | pangomm-doc | 2.40.1-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | soundtouch | 2.0.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | soundtouch-devel | 2.0.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | vala | 0.40.19-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | vala-devel | 0.40.19-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | woff2 | 1.0.2-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | woff2-devel | 1.0.2-5.el8 | ALSA-2021:1586 |
| Alpine:v3.20 | webkit2gtk | 2.30.3-r0 | ALPINE-CVE-2020-13543 |
| Debian:12 | webkit2gtk | 2.30.3-1 | DEBIAN-CVE-2020-13543 |
| Debian:13 | webkit2gtk | 2.30.3-1 | DEBIAN-CVE-2020-13543 |
| Debian:14 | webkit2gtk | 2.30.3-1 | DEBIAN-CVE-2020-13543 |
| Debian:12 | wpewebkit | 2.30.3-1 | DEBIAN-CVE-2020-13543 |
| Debian:13 | wpewebkit | 2.30.3-1 | DEBIAN-CVE-2020-13543 |
| Debian:14 | wpewebkit | 2.30.3-1 | DEBIAN-CVE-2020-13543 |
| Rocky Linux:8 | OpenEXR | 0:2.2.0-12.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | accountsservice | 0:0.6.55-1.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | atkmm | 0:2.24.2-7.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | cairomm | 0:1.12.0-8.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | chrome-gnome-shell | 0:10.1-7.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | dleyna-core | 0:0.6.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | dleyna-server | 0:0.6.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | enchant2 | 0:2.2.3-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gamin | 0:0.1.10-32.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gdm | 1:3.28.3-39.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | geoclue2 | 0:2.5.5-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | geocode-glib | 0:3.26.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gjs | 0:1.56.2-5.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | glibmm24 | 0:2.56.0-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-boxes | 0:3.36.5-8.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-boxes | 0:3.36.5-8.el8.rocky.0.1 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-control-center | 0:3.28.2-27.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-online-accounts | 0:3.28.2-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-photos | 0:3.28.1-4.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-settings-daemon | 0:3.32.0-14.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-shell | 0:3.32.2-30.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-software | 0:3.36.1-5.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-terminal | 0:3.28.3-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gtk-doc | 0:1.28-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gtk2 | 0:2.24.32-5.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gtkmm24 | 0:2.24.5-6.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gtkmm30 | 0:3.22.2-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gvfs | 0:1.36.2-11.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libdazzle | 0:3.28.5-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libepubgen | 0:0.1.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libsass | 0:3.4.5-6.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libsigc++20 | 0:2.10.0-6.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libvisual | 1:0.4.0-25.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | mutter | 0:3.32.2-57.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | nautilus | 0:3.28.1-15.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | pangomm | 0:2.40.1-6.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | soundtouch | 0:2.0.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | vala | 0:0.40.19-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | webkit2gtk3 | 0:2.30.4-1.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | woff2 | 0:1.0.2-5.el8 | RLSA-2021:1586 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2020-13543 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2020-13543 |
| Ubuntu:22.04:LTS | wpewebkit | no fix listed | UBUNTU-CVE-2020-13543 |
Affected products (as reported)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1155 x_refsource_MISC
- GLSA-202012-10 vendor-advisory, x_refsource_GENTOO
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC