Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-13558: WebKitGTK may run code from malicious web page
CVE-2020-13558 · published 5 years ago
Summary
The WebKitGTK 2.30.1 library used in Debian can be tricked by a crafted web page to execute its own code. This happens because the audio handling component releases memory too early, allowing the page to take control. Update to the latest package version or apply the provided security patch as soon as possible.
What to do
- Update debian webkit2gtk to version 2.30.5-1.
- Update debian wpewebkit to version 2.30.5-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | webkit2gtk |
< 2.30.5-1 Fix: upgrade to 2.30.5-1
|
| Debian:13 | debian | webkit2gtk |
< 2.30.5-1 Fix: upgrade to 2.30.5-1
|
| Debian:14 | debian | webkit2gtk |
< 2.30.5-1 Fix: upgrade to 2.30.5-1
|
| Debian:12 | debian | wpewebkit |
< 2.30.5-1 Fix: upgrade to 2.30.5-1
|
| Debian:13 | debian | wpewebkit |
< 2.30.5-1 Fix: upgrade to 2.30.5-1
|
| Debian:14 | debian | wpewebkit |
< 2.30.5-1 Fix: upgrade to 2.30.5-1
|
| – | webkitgtk | webkitgtk |
2.30.1 cpe:2.3:a:webkitgtk:webkitgtk:2.30.1:*:*:*:*:*:*:* |
Original advisory text
A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free.
A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free.
References
- https://security-tracker.debian.org/tracker/CVE-2020-13558 Vendor Advisory
- https://security.gentoo.org/glsa/202104-03 Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1172 Exploit Third Party Advisory
Severity
8.8
High
Type
CWE-416Use After Free
Timeline
Published3 Mar 2021
Updated3 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta