VDB

CVE-2020-13753

CVE-2020-13753 PUBLISHED

The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.

EPSS 2.17% · 84.6th percentile

Risk Scores

EPSS Score
2.17%
84.6th percentile

Affected Products

VendorProductVersions
Ubuntu:20.04:LTSwebkit2gtk2.26.2-1, 2.26.4-1ubuntu1, 2.28.1-1
Ubuntu:18.04:LTSwebkit2gtk2.22.2-0ubuntu0.18.04.1, 2.22.2-0ubuntu0.18.04.2, 2.22.4-0ubuntu0.18.04.1
Ubuntu:16.04:LTSwebkit2gtk2.14.5-0ubuntu0.16.04.1, 2.10.5-1, 2.10.6-1ubuntu1
Ubuntu:18.04:LTSwebkitgtk2.4.11-3ubuntu3, 0, 2.4.11-3
Ubuntu:16.04:LTSwebkitgtk2.4.9-2ubuntu2, 2.4.11-0ubuntu0.1, 2.4.10-0ubuntu1
Ubuntu:16.04:LTSqtwebkit-opensource-src5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1, 0
Ubuntu:16.04:LTSqtwebkit-source2.3.2-0ubuntu11, 0, 2.3.2-0ubuntu10
Ubuntu:18.04:LTSqtwebkit-source2.3.2-0ubuntu13, 0
Ubuntu:22.04:LTSqtwebkit-opensource-src0, 5.212.0~alpha4-12, 5.212.0~alpha4-13
Ubuntu:20.04:LTSqtwebkit-opensource-src5.212.0~alpha3-6, *, *
Ubuntu:24.04:LTSqtwebkit-opensource-src5.212.0~alpha4-33, *, 0
Ubuntu:18.04:LTSqtwebkit-opensource-src0, 5.9.1+dfsg-5ubuntu1, 5.212.0~alpha2-5build2

Timeline

  • Jul 13, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 22, 2021 EPSS Score
  • Oct 25, 2021 EPSS Score
  • Dec 27, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 1, 2022 EPSS Score
  • Jul 2, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score
  • Jan 7, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›