IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.8Hoch KEV

CVE-2019-8720WebKitGTK Memory Corruption Vulnerability

webkitgtk Veröffentlicht: (vor 3 Jahren)

Bekannt ausgenutzt — WebKitGTK Memory Corruption Vulnerability

CISA hat am 23.05.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 13.06.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-8720

Beschreibung

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

Schwachstellentyp (CWE): CWE-119

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
redhat codeready linux builder 8.0
redhat codeready linux builder eus 8.4
redhat codeready linux builder for arm64 eus 8.0
redhat codeready linux builder for ibm z systems eus 8.0
redhat codeready linux builder for power little endian eus 8.0
redhat enterprise linux 8.0
redhat enterprise linux desktop 7.0
redhat enterprise linux eus 8.4
redhat enterprise linux for arm64 eus 8.6
redhat enterprise linux for ibm z systems 7.0
redhat enterprise linux for ibm z systems eus 8.4
redhat enterprise linux for power big endian 7.0
redhat enterprise linux for power little endian 7.0
redhat enterprise linux for power little endian eus 8.4
redhat enterprise linux for scientific computing 7.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 8.4
redhat enterprise linux server for power little endian update services for sap solutions 8.4
redhat enterprise linux server tus 8.4
redhat enterprise linux server update services for sap solutions 8.4
redhat enterprise linux workstation 7.0
— webkitgtk Fixed in webkitgtk 2.26.0
webkitgtk webkitgtk < 2.26.0
wpewebkit wpe webkit < 2.26.0

Referenzen und Patches

CPE-Treffer (NVD) (41)
  • cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:* < 2.26.0
  • cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:* < 2.26.0
  • cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:arm64:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:arm64:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:arm64:*
  • cpe:2.3:o:redhat:enterprise_linux_for_arm64_eus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

6.5Mittel
CVE-2026-120831

Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4

A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating…

7.4Hoch
CVE-2026-120830

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause…

2.0Niedrig
CVE-2026-120740

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application pr…

7.5Hoch
CVE-2026-120194

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a ha…

6.5Mittel
CVE-2026-119842

Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDV…

6.5Mittel
CVE-2026-119727

Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-boun…