CVE-2020-13584

一、漏洞信息
 漏洞编号：[CVE-2020-13584](https://nvd.nist.gov/vuln/detail/CVE-2020-13584)
 漏洞归属组件：[atkmm](https://gitee.com/src-openeuler/atkmm)
 漏洞归属的版本：2.24.2,2.28.1,2.28.2,2.28.3,2.28.4
 CVSS V3.0分值：
  BaseScore：8.8 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
 漏洞简述：
  An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.
 漏洞公开时间：2020-12-04 01:15:12
 漏洞创建时间：2025-11-21 12:01:25
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2020-13584
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://www.auscert.org.au/bulletins/ESB-2020.4476/ |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1889411 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1903043 |  |
|  | https://talosintelligence.com/vulnerability_reports/TALOS-2020-1195 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1883304 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1796916 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1876291 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1901221 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2020.4175/ |  |
|  | https://www.auscert.org.au/bulletins/ESB-2021.1866 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1870837 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1860946 |  |
|  | https://security.gentoo.org/glsa/202012-10 |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BY2OBQZFMEFZOSWXPXHPEHOJXXILEEX2/ |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1921151 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1833787 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1871041 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2020.4175.2/ |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1861769 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1700002 |  |
|  | https://secdb.alpinelinux.org/edge/community.yaml |  |
|  | https://vulners.com/cve/CVE-2021-1817 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1671761 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1842229 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=837035 |  |
|  | https://vulners.com/cve/CVE-2019-13012 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2020-13584 |  |
|  | https://vulners.com/cve/CVE-2021-30661 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1888407 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1901214 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1728896 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1881312 |  |
|  | https://packetstormsecurity.com/files/162689/Red-Hat-Security-Advisory-2021-1586-01.html |  |
|  | https://vulners.com/cve/CVE-2020-13543 |  |
|  | https://packetstormsecurity.com/files/160701/Gentoo-Linux-Security-Advisory-202012-10.html |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1883868 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1846376 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1889528 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1919432 |  |
|  | https://www.cybersecurity-help.cz/vdb/SB2021092220 |  |
|  | https://access.redhat.com/security/cve/CVE-2020-13584 |  |
|  | https://vulners.com/cve/CVE-2021-1826 |  |
|  | https://vulners.com/cve/CVE-2020-13584 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1906499 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1919467 |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY2OBQZFMEFZOSWXPXHPEHOJXXILEEX2/ |  |
|  | https://errata.rockylinux.org/RLSA-2021:1586 |  |
|  | https://packetstormsecurity.com/files/163789/Red-Hat-Security-Advisory-2021-3119-01.html |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1865718 |  |
|  | https://www.debian.org/security/2020/dsa-4797 |  |
|  | https://vulners.com/cve/CVE-2021-1820 |  |
|  | https://packetstormsecurity.com/files/162837/Red-Hat-Security-Advisory-2021-2136-01.html |  |
|  | https://www.auscert.org.au/bulletins/ESB-2021.1820 |  |
|  | https://errata.almalinux.org/8/ALSA-2021-1586.html |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1728632 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1901216 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1901212 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1903568 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2020-13584 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1845660 |  |
|  | https://vulners.com/cve/CVE-2020-9951 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1854290 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1918391 |  |
|  | https://secdb.alpinelinux.org/v3.13/community.yaml |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1464902 |  |
|  | https://packetstormsecurity.com/files/163209/Red-Hat-Security-Advisory-2021-2479-01.html |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1765627 |  |
|  | https://webkitgtk.org/security/WSA-2020-0008.html |  |
|  | https://www.ibm.com/support/pages/node/6520474 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1705392 |  |
|  | https://vigilance.fr/vulnerability/WebKitGTK-WPE-WebKit-use-after-free-33958 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2021.2711 |  |
|  | https://vulners.com/cve/CVE-2020-9948 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1152037 |  |
|  | https://vulners.com/cve/CVE-2020-16125 |  |
|  | https://vulners.com/cve/CVE-2020-9983 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2021.4058 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2021.2160 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13584 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1886822 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2021.1721 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1919429 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1802105 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1786496 |  |
|  | https://www.cybersecurity-help.cz/vdb/SB2021052019 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1919435 |  |
|  | https://vulners.com/cve/CVE-2021-1825 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=1861357 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.
 openEuler评分：
  8.8
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(2.28.4):不受影响
2.openEuler-20.03-LTS-SP4(2.24.2):不受影响
3.openEuler-22.03-LTS-SP3(2.28.1):不受影响
4.openEuler-22.03-LTS-SP4(2.28.1):不受影响
5.openEuler-24.03-LTS(2.28.3):不受影响
6.openEuler-24.03-LTS-Next(2.28.3):不受影响
7.openEuler-24.03-LTS-SP1(2.28.3):不受影响
8.openEuler-24.03-LTS-SP2(2.28.3):不受影响
9.openEuler-24.03-LTS-SP3(2.28.3):不受影响

修复是否涉及abi变化(是/否)：
  1.master(2.28.4):否
2.openEuler-20.03-LTS-SP4(2.24.2):否
3.openEuler-22.03-LTS-SP3(2.28.1):否
4.openEuler-22.03-LTS-SP4(2.28.1):否
5.openEuler-24.03-LTS(2.28.3):否
6.openEuler-24.03-LTS-Next(2.28.3):否
7.openEuler-24.03-LTS-SP1(2.28.3):否
8.openEuler-24.03-LTS-SP2(2.28.3):否
9.openEuler-24.03-LTS-SP3(2.28.3):否

原因说明：
  1.master(2.28.4):不受影响-漏洞代码不存在
2.openEuler-20.03-LTS-SP4(2.24.2):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP3(2.28.1):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP4(2.28.1):不受影响-漏洞代码不存在
5.openEuler-24.03-LTS(2.28.3):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS-Next(2.28.3):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(2.28.3):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP2(2.28.3):不受影响-漏洞代码不存在
9.openEuler-24.03-LTS-SP3(2.28.3):不受影响-漏洞代码不存在

src-openEuler/atkmm
关闭

内容风险标识

评论 (6)

src-openEuler/atkmm关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2020-13584

评论 (6)

搜索帮助

src-openEuler/atkmm
关闭