CVE-2020-13753
EUVD-2020-597414.07.2020, 14:15
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| webkitgtk | webkitgtk | 𝑥 < 2.28.3 |
| wpewebkit | wpe_webkit | 𝑥 < 2.28.3 |
| debian | debian_linux | 10.0 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.10 |
| canonical | ubuntu_linux | 20.04 |
| opensuse | leap | 15.1 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| webkit2gtk |
| ||||||||||||||||
| wpewebkit |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| qtwebkit |
| ||||||||||||||||||||||||||
| qtwebkit-opensource-src |
| ||||||||||||||||||||||||||
| qtwebkit-source |
| ||||||||||||||||||||||||||
| webkit2gtk |
| ||||||||||||||||||||||||||
| webkitgtk |
|
Common Weakness Enumeration
References