Lucene search

K
ubuntucveUbuntu.comUB:CVE-2020-3895
HistoryApr 01, 2020 - 12:00 a.m.

CVE-2020-3895

2020-04-0100:00:00
ubuntu.com
ubuntu.com
26
memory corruption handling
ios 13.4
ipados 13.4
tvos 13.4
watchos 6.2
safari 13.1
itunes for windows 12.10.5
icloud for windows 10.9.3
icloud for windows 7.18
arbitrary code execution
malicious web content

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.01

Percentile

83.8%

A memory corruption issue was addressed with improved memory handling. This
issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari
13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for
Windows 7.18. Processing maliciously crafted web content may lead to
arbitrary code execution.

Notes

Author Note
jdstrand webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8
OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchwebkit2gtk< 2.28.0-0ubuntu0.18.04.3UNKNOWN
ubuntu19.10noarchwebkit2gtk< 2.28.0-0ubuntu0.19.10.2UNKNOWN
ubuntu20.04noarchwebkit2gtk< 2.28.0-1ubuntu2UNKNOWN
ubuntu20.10noarchwebkit2gtk< 2.28.0-1ubuntu2UNKNOWN
ubuntu21.04noarchwebkit2gtk< 2.28.0-1ubuntu2UNKNOWN
ubuntu21.10noarchwebkit2gtk< 2.28.0-1ubuntu2UNKNOWN
ubuntu22.04noarchwebkit2gtk< 2.28.0-1ubuntu2UNKNOWN
ubuntu22.10noarchwebkit2gtk< 2.28.0-1ubuntu2UNKNOWN
ubuntu23.04noarchwebkit2gtk< 2.28.0-1ubuntu2UNKNOWN
ubuntu23.10noarchwebkit2gtk< 2.28.0-1ubuntu2UNKNOWN
Rows per page:
1-10 of 111

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.01

Percentile

83.8%