CVE-2020-13753
Fixed in a distro release EPSS 3%
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
Products: webkitgtk, wpewebkit wpe_webkit, fedoraproject fedora, debian_linux, canonical ubuntu_linux, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | webkit2gtk | 2.28.3-2~deb10u1 |
| Debian 12 | webkit2gtk | 2.28.3-1 |
| Debian 12 | wpewebkit | 2.28.3-1 |
| Debian 13 | webkit2gtk | 2.28.3-1 |
| Debian 13 | wpewebkit | 2.28.3-1 |
| Debian 14 | webkit2gtk | 2.28.3-1 |
| Debian 14 | wpewebkit | 2.28.3-1 |
| Red Hat rhel els 7 | webkitgtk4 | 0:2.48.3-2.el7_9 |
| Red Hat rhel els 7 | webkitgtk4-debuginfo | 0:2.48.3-2.el7_9 |
| Red Hat rhel els 7 | webkitgtk4-devel | 0:2.48.3-2.el7_9 |
| Red Hat rhel els 7 | webkitgtk4-doc | 0:2.48.3-2.el7_9 |
| Red Hat rhel els 7 | webkitgtk4-jsc | 0:2.48.3-2.el7_9 |
| Red Hat rhel els 7 | webkitgtk4-jsc-devel | 0:2.48.3-2.el7_9 |
| SUSE Enterprise Storage 5 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Enterprise Storage 6 | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Enterprise Storage 7 | webkit2gtk3 | 2.34.3-23.3 |
| SUSE HPE Helion OpenStack 8 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE HPE Helion OpenStack 8 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | webkit2gtk3 | 2.28.3-3.57.2 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | webkit2gtk3 | 2.28.3-3.57.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | webkit2gtk3 | 2.28.3-3.57.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | webkit2gtk3 | 2.28.3-3.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP1 | webkit2gtk3 | 2.28.3-3.57.2 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP2 | webkit2gtk3 | 2.28.3-3.3.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP3 | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Linux Enterprise Real Time 15 SP2 | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Linux Enterprise Server 12 SP2-BCL | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server 12 SP5 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server 12 SP5 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Linux Enterprise Server 15-LTSS | webkit2gtk3 | 2.28.3-3.57.2 |
| SUSE Linux Enterprise Server 15-LTSS | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | webkit2gtk3 | 2.28.3-3.57.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | webkit2gtk3 | 2.34.3-3.92.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE Manager Proxy 4.1 | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Manager Retail Branch Server 4.1 | webkit2gtk3 | 2.34.3-23.3 |
| SUSE Manager Server 4.1 | webkit2gtk3 | 2.34.3-23.3 |
| SUSE OpenStack Cloud 7 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE OpenStack Cloud 8 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE OpenStack Cloud 8 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE OpenStack Cloud 9 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE OpenStack Cloud 9 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE OpenStack Cloud Crowbar 8 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE OpenStack Cloud Crowbar 8 | webkit2gtk3 | 2.34.3-2.82.1 |
| SUSE OpenStack Cloud Crowbar 9 | webkit2gtk3 | 2.28.3-2.56.1 |
| SUSE OpenStack Cloud Crowbar 9 | webkit2gtk3 | 2.34.3-2.82.1 |
| Ubuntu 16.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 16.04 LTS | qtwebkit-source | no fix |
| Ubuntu 16.04 LTS | webkit2gtk | no fix |
| Ubuntu 16.04 LTS | webkitgtk | no fix |
| Ubuntu 18.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 18.04 LTS | qtwebkit-source | no fix |
| Ubuntu 18.04 LTS | webkit2gtk | 2.30.3-0ubuntu0.18.04.1 |
| Ubuntu 18.04 LTS | webkit2gtk | 2.28.3-0ubuntu0.18.04.1 |
| Ubuntu 18.04 LTS | webkitgtk | no fix |
| Ubuntu 20.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 20.04 LTS | webkit2gtk | 2.28.3-0ubuntu0.20.04.1 |
| Ubuntu 20.04 LTS | webkit2gtk | 2.30.3-0ubuntu0.20.04.1 |
| Ubuntu 22.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 24.04 LTS | qtwebkit-opensource-src | no fix |
| openSUSE Leap 15.1 | webkit2gtk3 | 2.28.3-lp151.2.21.1 |
| openSUSE Leap 15.3 | webkit2gtk3 | 2.34.3-23.3 |
| openSUSE Tumbleweed | gtk3 | 2.32.4-1.1 |