Vulnerability Spotlight: Multiple vulnerabilities in WebKit

guest · Nov 30, 2020

Vulnerability Spotlight: Multiple vulnerabilities in WebKit
November 30, 2020
https://blog.talosintelligence.com/2020/11/vuln-spotlight-webkit-use-after-free-nov-2020.html

The WebKit browser engine contains multiple vulnerabilities in various functions of the software. A malicious web page code could trigger multiple use-after-free errors, which could lead to remote and arbitrary code execution. An attacker could exploit these vulnerabilities by tricking the user into visiting a specially crafted, malicious web page on a browser utilizing WebKit.

Talos tested and confirmed that Webkit WebKitGTK, version 2.30.0, is affected by TALOS-2020-1155. TALOS-2020-1172 and TALOS-2020-1195 affect version 2.30.1.
Click to expand...

SecurityWeek: WebKit Vulnerabilities Allow Remote Code Execution via Malicious Websites

WebKit is an open source engine that has been used by Safari and other Apple products, as well as many other apps for macOS, iOS and Linux.
The vulnerabilities are related to WebKit’s WebSocket, AudioSourceProviderGStreamer and ImageDecoderGStreamer functionality.

According to Talos, the flaws were reported this fall and they were patched earlier this month. The CVE identifiers CVE-2020-13584, CVE-2020-13558 and CVE-2020-13543 have been assigned.
Click to expand...

An advisory published last week by the developers of WebKitGTK, a full-featured port of WebKit, and WPE, the WebKit implementation for embedded and low-consumption devices, mentions two code execution vulnerabilities found by Talos — one disclosed now and one disclosed in September — as well as several flaws reported by other researchers.

Apple will likely patch the latest WebKit vulnerabilities with upcoming software updates.
Click to expand...

Log in or Sign up

Vulnerability Spotlight: Multiple vulnerabilities in WebKit

guest Guest

Log in or Sign up

Vulnerability Spotlight: Multiple vulnerabilities in WebKit

guest Guest

Useful Searches