RHEL 7 : webkitgtk4 (RHSA-2020:4035)

High Nessus Plugin ID 143094

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 9

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4035 advisory.

- webkitgtk: HTTP proxy setting deanonymization information disclosure (CVE-2019-11070)

- webkitgtk: Multiple memory corruption issues leading to arbitrary code execution (CVE-2019-6237, CVE-2019-8571, CVE-2019-8583, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595, CVE-2019-8596, CVE-2019-8597, CVE-2019-8601, CVE-2019-8608, CVE-2019-8609, CVE-2019-8610, CVE-2019-8611, CVE-2019-8615, CVE-2019-8619, CVE-2019-8622, CVE-2019-8623, CVE-2019-8644, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8707, CVE-2019-8710, CVE-2019-8720, CVE-2019-8726, CVE-2019-8733, CVE-2019-8735, CVE-2019-8763, CVE-2019-8765, CVE-2019-8766, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823, CVE-2020-3868)

- webkitgtk: processing maliciously crafted web content lead to URI spoofing (CVE-2019-6251)

- webkitgtk: malicous web content leads to arbitrary code execution (CVE-2019-8506)

- webkitgtk: malicious web content leads to arbitrary code execution (CVE-2019-8524, CVE-2019-8559, CVE-2019-8563)

- webkitgtk: malicious crafted web content leads to arbitrary code execution (CVE-2019-8535, CVE-2019-8536, CVE-2019-8558)

- webkitgtk: malicious crafted web content leads to arbitrary we content (CVE-2019-8544)

- webkitgtk: malicious web content leads to cross site scripting (CVE-2019-8551)

- webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2019-8607)

- webkitgtk: Incorrect state management leading to universal cross-site scripting (CVE-2019-8625, CVE-2019-8649, CVE-2019-8658, CVE-2019-8674, CVE-2019-8690, CVE-2019-8719, CVE-2019-8813, CVE-2020-3867)

- webkitgtk: Multiple memory corruption issues leading to arbitrary code execution (CVE-2019-8743)

- webkitgtk: Incorrect state management leading to universal cross-site scripting (CVE-2019-8764)

- webkitgtk: Browsing history could not be deleted (CVE-2019-8768)

- webkitgtk: Websites could reveal browsing history (CVE-2019-8769)

- webkitgtk: Violation of iframe sandboxing policy (CVE-2019-8771)

- webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2019-8835, CVE-2019-8844)

- webkitgtk: Use after free issue may lead to remote code execution (CVE-2019-8846)

- webkitgtk: Use-after-free issue in accessibility/AXObjectCache.cpp (CVE-2020-10018)

- webkitgtk: use-after-free via crafted web content (CVE-2020-11793)

- webkitgtk: Denial of service via incorrect memory handling (CVE-2020-3862)

- webkitgtk: Non-unique security origin for DOM object contexts (CVE-2020-3864)

- webkitgtk: Incorrect security check for a top-level DOM object context (CVE-2020-3865)

- webkitgtk: Incorrect processing of file URLs (CVE-2020-3885)

- webkitgtk: Race condition allows reading of restricted memory (CVE-2020-3894)

- webkitgtk: Memory corruption triggered by a malicious web content (CVE-2020-3895)

- webkitgtk: Type confusion leading to arbitrary code execution (CVE-2020-3897, CVE-2020-3901)

- webkitgtk: Memory consumption issue leading to arbitrary code execution (CVE-2020-3899)

- webkitgtk: Memory corruption triggered by a malicious web content (CVE-2020-3900)

- webkitgtk: Input validation issue leading to cross-site script attack (CVE-2020-3902)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://cwe.mitre.org/data/definitions/20.html

https://cwe.mitre.org/data/definitions/79.html

https://cwe.mitre.org/data/definitions/94.html

https://cwe.mitre.org/data/definitions/119.html

https://cwe.mitre.org/data/definitions/200.html

https://cwe.mitre.org/data/definitions/400.html

https://cwe.mitre.org/data/definitions/416.html

https://access.redhat.com/security/cve/CVE-2019-6237

https://access.redhat.com/security/cve/CVE-2019-6251

https://access.redhat.com/security/cve/CVE-2019-8506

https://access.redhat.com/security/cve/CVE-2019-8524

https://access.redhat.com/security/cve/CVE-2019-8535

https://access.redhat.com/security/cve/CVE-2019-8536

https://access.redhat.com/security/cve/CVE-2019-8544

https://access.redhat.com/security/cve/CVE-2019-8551

https://access.redhat.com/security/cve/CVE-2019-8558

https://access.redhat.com/security/cve/CVE-2019-8559

https://access.redhat.com/security/cve/CVE-2019-8563

https://access.redhat.com/security/cve/CVE-2019-8571

https://access.redhat.com/security/cve/CVE-2019-8583

https://access.redhat.com/security/cve/CVE-2019-8584

https://access.redhat.com/security/cve/CVE-2019-8586

https://access.redhat.com/security/cve/CVE-2019-8587

https://access.redhat.com/security/cve/CVE-2019-8594

https://access.redhat.com/security/cve/CVE-2019-8595

https://access.redhat.com/security/cve/CVE-2019-8596

https://access.redhat.com/security/cve/CVE-2019-8597

https://access.redhat.com/security/cve/CVE-2019-8601

https://access.redhat.com/security/cve/CVE-2019-8607

https://access.redhat.com/security/cve/CVE-2019-8608

https://access.redhat.com/security/cve/CVE-2019-8609

https://access.redhat.com/security/cve/CVE-2019-8610

https://access.redhat.com/security/cve/CVE-2019-8611

https://access.redhat.com/security/cve/CVE-2019-8615

https://access.redhat.com/security/cve/CVE-2019-8619

https://access.redhat.com/security/cve/CVE-2019-8622

https://access.redhat.com/security/cve/CVE-2019-8623

https://access.redhat.com/security/cve/CVE-2019-8625

https://access.redhat.com/security/cve/CVE-2019-8644

https://access.redhat.com/security/cve/CVE-2019-8649

https://access.redhat.com/security/cve/CVE-2019-8658

https://access.redhat.com/security/cve/CVE-2019-8666

https://access.redhat.com/security/cve/CVE-2019-8669

https://access.redhat.com/security/cve/CVE-2019-8671

https://access.redhat.com/security/cve/CVE-2019-8672

https://access.redhat.com/security/cve/CVE-2019-8673

https://access.redhat.com/security/cve/CVE-2019-8674

https://access.redhat.com/security/cve/CVE-2019-8676

https://access.redhat.com/security/cve/CVE-2019-8677

https://access.redhat.com/security/cve/CVE-2019-8678

https://access.redhat.com/security/cve/CVE-2019-8679

https://access.redhat.com/security/cve/CVE-2019-8680

https://access.redhat.com/security/cve/CVE-2019-8681

https://access.redhat.com/security/cve/CVE-2019-8683

https://access.redhat.com/security/cve/CVE-2019-8684

https://access.redhat.com/security/cve/CVE-2019-8686

https://access.redhat.com/security/cve/CVE-2019-8687

https://access.redhat.com/security/cve/CVE-2019-8688

https://access.redhat.com/security/cve/CVE-2019-8689

https://access.redhat.com/security/cve/CVE-2019-8690

https://access.redhat.com/security/cve/CVE-2019-8707

https://access.redhat.com/security/cve/CVE-2019-8710

https://access.redhat.com/security/cve/CVE-2019-8719

https://access.redhat.com/security/cve/CVE-2019-8720

https://access.redhat.com/security/cve/CVE-2019-8726

https://access.redhat.com/security/cve/CVE-2019-8733

https://access.redhat.com/security/cve/CVE-2019-8735

https://access.redhat.com/security/cve/CVE-2019-8743

https://access.redhat.com/security/cve/CVE-2019-8763

https://access.redhat.com/security/cve/CVE-2019-8764

https://access.redhat.com/security/cve/CVE-2019-8765

https://access.redhat.com/security/cve/CVE-2019-8766

https://access.redhat.com/security/cve/CVE-2019-8768

https://access.redhat.com/security/cve/CVE-2019-8769

https://access.redhat.com/security/cve/CVE-2019-8771

https://access.redhat.com/security/cve/CVE-2019-8782

https://access.redhat.com/security/cve/CVE-2019-8783

https://access.redhat.com/security/cve/CVE-2019-8808

https://access.redhat.com/security/cve/CVE-2019-8811

https://access.redhat.com/security/cve/CVE-2019-8812

https://access.redhat.com/security/cve/CVE-2019-8813

https://access.redhat.com/security/cve/CVE-2019-8814

https://access.redhat.com/security/cve/CVE-2019-8815

https://access.redhat.com/security/cve/CVE-2019-8816

https://access.redhat.com/security/cve/CVE-2019-8819

https://access.redhat.com/security/cve/CVE-2019-8820

https://access.redhat.com/security/cve/CVE-2019-8821

https://access.redhat.com/security/cve/CVE-2019-8822

https://access.redhat.com/security/cve/CVE-2019-8823

https://access.redhat.com/security/cve/CVE-2019-8835

https://access.redhat.com/security/cve/CVE-2019-8844

https://access.redhat.com/security/cve/CVE-2019-8846

https://access.redhat.com/security/cve/CVE-2019-11070

https://access.redhat.com/security/cve/CVE-2020-3862

https://access.redhat.com/security/cve/CVE-2020-3864

https://access.redhat.com/security/cve/CVE-2020-3865

https://access.redhat.com/security/cve/CVE-2020-3867

https://access.redhat.com/security/cve/CVE-2020-3868

https://access.redhat.com/security/cve/CVE-2020-3885

https://access.redhat.com/security/cve/CVE-2020-3894

https://access.redhat.com/security/cve/CVE-2020-3895

https://access.redhat.com/security/cve/CVE-2020-3897

https://access.redhat.com/security/cve/CVE-2020-3899

https://access.redhat.com/security/cve/CVE-2020-3900

https://access.redhat.com/security/cve/CVE-2020-3901

https://access.redhat.com/security/cve/CVE-2020-3902

https://access.redhat.com/security/cve/CVE-2020-10018

https://access.redhat.com/security/cve/CVE-2020-11793

https://access.redhat.com/errata/RHSA-2020:4035

https://bugzilla.redhat.com/1667409

https://bugzilla.redhat.com/1709289

https://bugzilla.redhat.com/1719199

https://bugzilla.redhat.com/1719209

https://bugzilla.redhat.com/1719210

https://bugzilla.redhat.com/1719213

https://bugzilla.redhat.com/1719224

https://bugzilla.redhat.com/1719231

https://bugzilla.redhat.com/1719235

https://bugzilla.redhat.com/1719237

https://bugzilla.redhat.com/1719238

https://bugzilla.redhat.com/1811721

https://bugzilla.redhat.com/1816678

https://bugzilla.redhat.com/1816684

https://bugzilla.redhat.com/1816686

https://bugzilla.redhat.com/1829369

https://bugzilla.redhat.com/1876462

https://bugzilla.redhat.com/1876463

https://bugzilla.redhat.com/1876465

https://bugzilla.redhat.com/1876468

https://bugzilla.redhat.com/1876470

https://bugzilla.redhat.com/1876472

https://bugzilla.redhat.com/1876473

https://bugzilla.redhat.com/1876476

https://bugzilla.redhat.com/1876516

https://bugzilla.redhat.com/1876518

https://bugzilla.redhat.com/1876521

https://bugzilla.redhat.com/1876522

https://bugzilla.redhat.com/1876523

https://bugzilla.redhat.com/1876536

https://bugzilla.redhat.com/1876537

https://bugzilla.redhat.com/1876540

https://bugzilla.redhat.com/1876542

https://bugzilla.redhat.com/1876543

https://bugzilla.redhat.com/1876545

https://bugzilla.redhat.com/1876548

https://bugzilla.redhat.com/1876549

https://bugzilla.redhat.com/1876550

https://bugzilla.redhat.com/1876552

https://bugzilla.redhat.com/1876553

https://bugzilla.redhat.com/1876554

https://bugzilla.redhat.com/1876555

https://bugzilla.redhat.com/1876556

https://bugzilla.redhat.com/1876590

https://bugzilla.redhat.com/1876591

https://bugzilla.redhat.com/1876592

https://bugzilla.redhat.com/1876593

https://bugzilla.redhat.com/1876594

https://bugzilla.redhat.com/1876607

https://bugzilla.redhat.com/1876608

https://bugzilla.redhat.com/1876609

https://bugzilla.redhat.com/1876610

https://bugzilla.redhat.com/1876611

https://bugzilla.redhat.com/1876612

https://bugzilla.redhat.com/1876613

https://bugzilla.redhat.com/1876614

https://bugzilla.redhat.com/1876615

https://bugzilla.redhat.com/1876616

https://bugzilla.redhat.com/1876617

https://bugzilla.redhat.com/1876619

https://bugzilla.redhat.com/1876626

https://bugzilla.redhat.com/1876628

https://bugzilla.redhat.com/1876629

https://bugzilla.redhat.com/1876630

https://bugzilla.redhat.com/1876631

https://bugzilla.redhat.com/1876632

https://bugzilla.redhat.com/1876634

https://bugzilla.redhat.com/1876643

https://bugzilla.redhat.com/1876644

https://bugzilla.redhat.com/1876645

https://bugzilla.redhat.com/1876646

https://bugzilla.redhat.com/1876647

https://bugzilla.redhat.com/1876648

https://bugzilla.redhat.com/1876650

https://bugzilla.redhat.com/1876651

https://bugzilla.redhat.com/1876652

https://bugzilla.redhat.com/1876653

https://bugzilla.redhat.com/1876655

https://bugzilla.redhat.com/1876656

https://bugzilla.redhat.com/1876657

https://bugzilla.redhat.com/1876664

https://bugzilla.redhat.com/1876880

https://bugzilla.redhat.com/1876881

https://bugzilla.redhat.com/1876882

https://bugzilla.redhat.com/1876883

https://bugzilla.redhat.com/1876884

https://bugzilla.redhat.com/1876887

https://bugzilla.redhat.com/1876891

https://bugzilla.redhat.com/1876892

https://bugzilla.redhat.com/1876893

https://bugzilla.redhat.com/1876894

https://bugzilla.redhat.com/1876895

https://bugzilla.redhat.com/1876897

https://bugzilla.redhat.com/1876898

https://bugzilla.redhat.com/1876899

https://bugzilla.redhat.com/1876900

https://bugzilla.redhat.com/1877045

https://bugzilla.redhat.com/1877046

https://bugzilla.redhat.com/1877047

https://bugzilla.redhat.com/1877048

https://bugzilla.redhat.com/1877049

Plugin Details

Severity: High

ID: 143094

File Name: redhat-RHSA-2020-4035.nasl

Version: 1.3

Type: local

Agent: unix

Published: 2020/11/19

Updated: 2020/11/24

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 9

CVSS Score Source: CVE-2020-3899

CVSS v2.0

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSS v3.0

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:7::client, cpe:/o:redhat:enterprise_linux:7::computenode, cpe:/o:redhat:enterprise_linux:7::server, cpe:/o:redhat:enterprise_linux:7::workstation, p-cpe:/a:redhat:enterprise_linux:webkitgtk4, p-cpe:/a:redhat:enterprise_linux:webkitgtk4-devel, p-cpe:/a:redhat:enterprise_linux:webkitgtk4-doc, p-cpe:/a:redhat:enterprise_linux:webkitgtk4-jsc, p-cpe:/a:redhat:enterprise_linux:webkitgtk4-jsc-devel

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2020/09/29

Vulnerability Publication Date: 2019/01/14

Reference Information

CVE: CVE-2019-6237, CVE-2019-6251, CVE-2019-8506, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-8571, CVE-2019-8583, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595, CVE-2019-8596, CVE-2019-8597, CVE-2019-8601, CVE-2019-8607, CVE-2019-8608, CVE-2019-8609, CVE-2019-8610, CVE-2019-8611, CVE-2019-8615, CVE-2019-8619, CVE-2019-8622, CVE-2019-8623, CVE-2019-8625, CVE-2019-8644, CVE-2019-8649, CVE-2019-8658, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8674, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8690, CVE-2019-8707, CVE-2019-8710, CVE-2019-8719, CVE-2019-8720, CVE-2019-8726, CVE-2019-8733, CVE-2019-8735, CVE-2019-8743, CVE-2019-8763, CVE-2019-8764, CVE-2019-8765, CVE-2019-8766, CVE-2019-8768, CVE-2019-8769, CVE-2019-8771, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846, CVE-2019-11070, CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, CVE-2020-3885, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-10018, CVE-2020-11793

BID: 108497, 108566, 109328, 109329

RHSA: 2020:4035

CWE: 20, 79, 94, 119, 200, 400, 416