CVE-2020-11793

What it actually does

A use-after-free vulnerability in the WebKit rendering engine allows crafted web content to trigger memory corruption, potentially leading to arbitrary code execution or application crash.

Why it matters to the business

Attackers can compromise systems running vulnerable web browsers or applications using WebKit, leading to data theft, malware installation, or service disruption. Given the age of the vulnerability, most systems should already be updated, but unpatched legacy systems remain at risk.

How an attack unfolds

An attacker crafts malicious web content that exploits the use-after-free condition in WebKitGTK or WPE WebKit. When a user visits the page or the content is loaded, the flaw is triggered, allowing memory corruption and code execution.

How to fix it

Upgrade WebKitGTK to version 2.28.1 or later and WPE WebKit to 2.28.1 or later.

How to confirm the fix worked

Check the version of WebKitGTK and WPE WebKit installed and confirm it is at least 2.28.1. Monitor for crashes or unexpected behavior in web content rendering.

Typical attack path

1. Deliver crafted web content to target via phishing or malicious site
2. Victim's browser processes the content triggering use-after-free
3. Exploit memory corruption for code execution or crash

How to detect it

Look for unusual crashes in WebKit-based applications, review web server logs for access to suspicious URLs, and check system memory dumps for signs of exploitation attempts.

What your security team should do

• Update all affected WebKit components to fixed versions immediately
• Scan for any remaining vulnerable installations
• Educate users on avoiding suspicious web content