CVE-2019-8720

CVE-2019-8720 is a memory corruption flaw (CWE-119) in the WebKit engine as packaged in WebKitGTK and WPE WebKit, in which multiple memory-handling errors can be triggered by processing maliciously crafted web content. An attacker who gets a user to load attacker-controlled HTML — for example through an application that uses WebKitGTK to render email, feeds, or other web content — can corrupt memory and potentially execute arbitrary code with the privileges of that application. The CVSS 3.1 score of 8.8 (high) reflects that the attack path is network-based, requires no privileges but does require user interaction, and yields high impact on confidentiality, integrity, and availability. Users of WebKitGTK and WPE WebKit, including the packages shipped with Red Hat Enterprise Linux and its desktop, EUS, and architecture-specific variants, are affected. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 2022-05-23, indicating known exploitation in the wild; no public proof-of-concept is known, and EPSS estimates a 1.6% probability of exploitation in the next 30 days.

What to do: Apply updated WebKitGTK/WPE WebKit packages per vendor instructions — for Red Hat Enterprise Linux, install the corrected packages from Red Hat security errata for your release — and prioritize systems where users view untrusted HTML, such as mail, feed, or desktop applications that embed WebKitGTK. As an interim mitigation, avoid rendering untrusted web content in applications that use WebKitGTK. Inventory hosts for webkitgtk/webkit2gtk packages and confirm they are on the patched release for your Red Hat Enterprise Linux version.