Vulnerabilities / CVE-2020-10018

critical

CVE-2020-10018

webkitgtk: Use-after-free issue in accessibility/AXObjectCache.cpp

Published Modified CWE 416
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), AlmaLinux (medium), Amazon (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium).

Description

WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.

Affected packages and fixed versions

SourcePackageFixed in
alma 8LibRaw-devel, PackageKit, PackageKit-command-not-found and 31 more0.19.5-2.el8 and 16 more
alpine 3.11webkit2gtk2.28.0-r0
alpine 3.12webkit2gtk2.28.0-r0
alpine 3.13webkit2gtk2.28.0-r0
alpine 3.14webkit2gtk2.28.0-r0
alpine 3.15webkit2gtk2.28.0-r0
alpine 3.16webkit2gtk2.28.0-r0
alpine 3.17webkit2gtk2.28.0-r0
alpine 3.18webkit2gtk2.28.0-r0
alpine 3.19webkit2gtk2.28.0-r0
alpine 3.20webkit2gtk2.28.0-r0
amazon linux 2webkitgtk4, webkitgtk4-debuginfo, webkitgtk4-devel and 3 more2.28.2-2.amzn2.0.1
Show all 221 entries from 37 sources
SourcePackageFixed in
alma 8LibRaw-devel0.19.5-2.el8
alma 8PackageKit1.1.12-6.el8
alma 8PackageKit-command-not-found1.1.12-6.el8
alma 8PackageKit-cron1.1.12-6.el8
alma 8PackageKit-glib1.1.12-6.el8
alma 8PackageKit-glib-devel1.1.12-6.el8
alma 8PackageKit-gstreamer-plugin1.1.12-6.el8
alma 8PackageKit-gtk3-module1.1.12-6.el8
alma 8dleyna-renderer0.6.0-3.el8
alma 8frei0r-devel1.6.1-7.el8
alma 8frei0r-plugins1.6.1-7.el8
alma 8frei0r-plugins-opencv1.6.1-7.el8
alma 8gnome-remote-desktop0.1.8-3.el8
alma 8gtk-doc1.28-2.el8
alma 8libsoup-devel2.62.3-2.el8
alma 8mutter-devel3.32.2-48.el8
alma 8nautilus-devel3.28.1-14.el8
alma 8pipewire0.3.6-1.el8
alma 8pipewire-devel0.3.6-1.el8
alma 8pipewire-doc0.3.6-1.el8
alma 8pipewire-libs0.3.6-1.el8
alma 8pipewire-utils0.3.6-1.el8
alma 8pipewire0.2-devel0.2.7-6.el8
alma 8pipewire0.2-libs0.2.7-6.el8
alma 8potrace1.15-3.el8
alma 8pygobject3-devel3.28.3-2.el8
alma 8python3-gobject3.28.3-2.el8
alma 8tracker2.1.5-2.el8
alma 8tracker-devel2.1.5-2.el8
alma 8vte-profile0.52.4-2.el8
alma 8vte2910.52.4-2.el8
alma 8vte291-devel0.52.4-2.el8
alma 8webrtc-audio-processing0.3-9.el8
alma 8xdg-desktop-portal-gtk1.6.0-1.el8
alpine 3.11webkit2gtk2.28.0-r0
alpine 3.12webkit2gtk2.28.0-r0
alpine 3.13webkit2gtk2.28.0-r0
alpine 3.14webkit2gtk2.28.0-r0
alpine 3.15webkit2gtk2.28.0-r0
alpine 3.16webkit2gtk2.28.0-r0
alpine 3.17webkit2gtk2.28.0-r0
alpine 3.18webkit2gtk2.28.0-r0
alpine 3.19webkit2gtk2.28.0-r0
alpine 3.20webkit2gtk2.28.0-r0
amazon linux 2webkitgtk42.28.2-2.amzn2.0.1
amazon linux 2webkitgtk4-debuginfo2.28.2-2.amzn2.0.1
amazon linux 2webkitgtk4-devel2.28.2-2.amzn2.0.1
amazon linux 2webkitgtk4-doc2.28.2-2.amzn2.0.1
amazon linux 2webkitgtk4-jsc2.28.2-2.amzn2.0.1
amazon linux 2webkitgtk4-jsc-devel2.28.2-2.amzn2.0.1
debian 10webkit2gtk2.26.4-1~deb10u2
debian 11webkit2gtk2.28.0-2
debian 11wpewebkit2.28.0-1
debian 12webkit2gtk2.28.0-2
debian 12wpewebkit2.28.0-1
debian 13webkit2gtk2.28.0-2
debian 13wpewebkit2.28.0-1
debian 14webkit2gtk2.28.0-2
debian 14wpewebkit2.28.0-1
debian 8webkit2gtkno fix listed
debian 9webkit2gtkno fix listed
echowebkit2gtk2.28.0-2
echowpewebkit2.28.0-1
Oracle Linux 7webkitgtk42.28.2-2.el7
Oracle Linux 7webkitgtk4-devel2.28.2-2.el7
Oracle Linux 7webkitgtk4-doc2.28.2-2.el7
Oracle Linux 7webkitgtk4-jsc2.28.2-2.el7
Oracle Linux 7webkitgtk4-jsc-devel2.28.2-2.el7
Oracle Linux 8LibRaw0.19.5-2.el8
Oracle Linux 8LibRaw-devel0.19.5-2.el8
Oracle Linux 8PackageKit1.1.12-6.0.1.el8
Oracle Linux 8PackageKit-command-not-found1.1.12-6.0.1.el8
Oracle Linux 8PackageKit-cron1.1.12-6.0.1.el8
Oracle Linux 8PackageKit-glib1.1.12-6.0.1.el8
Oracle Linux 8PackageKit-glib-devel1.1.12-6.0.1.el8
Oracle Linux 8PackageKit-gstreamer-plugin1.1.12-6.0.1.el8
Oracle Linux 8PackageKit-gtk3-module1.1.12-6.0.1.el8
Oracle Linux 8dleyna-renderer0.6.0-3.el8
Oracle Linux 8frei0r-devel1.6.1-7.el8
Oracle Linux 8frei0r-plugins1.6.1-7.el8
Oracle Linux 8frei0r-plugins-opencv1.6.1-7.el8
Oracle Linux 8gdm1:3.28.3-34.el8
Oracle Linux 8gnome-classic-session3.32.1-11.el8
Oracle Linux 8gnome-control-center3.28.2-22.el8
Oracle Linux 8gnome-control-center-filesystem3.28.2-22.el8
Oracle Linux 8gnome-photos3.28.1-3.el8
Oracle Linux 8gnome-photos-tests3.28.1-3.el8
Oracle Linux 8gnome-remote-desktop0.1.8-3.el8
Oracle Linux 8gnome-session3.28.1-10.0.1.el8
Oracle Linux 8gnome-session-wayland-session3.28.1-10.0.1.el8
Oracle Linux 8gnome-session-xsession3.28.1-10.0.1.el8
Oracle Linux 8gnome-settings-daemon3.32.0-11.el8
Oracle Linux 8gnome-shell3.32.2-20.el8
Oracle Linux 8gnome-shell-extension-apps-menu3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-auto-move-windows3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-common3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-dash-to-dock3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-desktop-icons3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-disable-screenshield3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-drive-menu3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-horizontal-workspaces3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-launch-new-instance3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-native-window-placement3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-no-hot-corner3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-panel-favorites3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-places-menu3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-screenshot-window-sizer3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-systemMonitor3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-top-icons3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-updates-dialog3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-user-theme3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-window-grouper3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-window-list3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-windowsNavigator3.32.1-11.el8
Oracle Linux 8gnome-shell-extension-workspace-indicator3.32.1-11.el8
Oracle Linux 8gnome-terminal3.28.3-2.el8
Oracle Linux 8gnome-terminal-nautilus3.28.3-2.el8
Oracle Linux 8gsettings-desktop-schemas3.32.0-5.el8
Oracle Linux 8gsettings-desktop-schemas-devel3.32.0-5.el8
Oracle Linux 8gtk-doc1.28-2.el8
Oracle Linux 8gtk-update-icon-cache3.22.30-6.el8
Oracle Linux 8gtk33.22.30-6.el8
Oracle Linux 8gtk3-devel3.22.30-6.el8
Oracle Linux 8gtk3-immodule-xim3.22.30-6.el8
Oracle Linux 8gvfs1.36.2-10.el8
Oracle Linux 8gvfs-afc1.36.2-10.el8
Oracle Linux 8gvfs-afp1.36.2-10.el8
Oracle Linux 8gvfs-archive1.36.2-10.el8
Oracle Linux 8gvfs-client1.36.2-10.el8
Oracle Linux 8gvfs-devel1.36.2-10.el8
Oracle Linux 8gvfs-fuse1.36.2-10.el8
Oracle Linux 8gvfs-goa1.36.2-10.el8
Oracle Linux 8gvfs-gphoto21.36.2-10.el8
Oracle Linux 8gvfs-mtp1.36.2-10.el8
Oracle Linux 8gvfs-smb1.36.2-10.el8
Oracle Linux 8libsoup2.62.3-2.el8
Oracle Linux 8libsoup-devel2.62.3-2.el8
Oracle Linux 8mutter3.32.2-48.el8
Oracle Linux 8mutter-devel3.32.2-48.el8
Oracle Linux 8nautilus3.28.1-14.el8
Oracle Linux 8nautilus-devel3.28.1-14.el8
Oracle Linux 8nautilus-extensions3.28.1-14.el8
Oracle Linux 8pipewire0.3.6-1.el8
Oracle Linux 8pipewire-devel0.3.6-1.el8
Oracle Linux 8pipewire-doc0.3.6-1.el8
Oracle Linux 8pipewire-libs0.3.6-1.el8
Oracle Linux 8pipewire-utils0.3.6-1.el8
Oracle Linux 8pipewire0.2-devel0.2.7-6.el8
Oracle Linux 8pipewire0.2-libs0.2.7-6.el8
Oracle Linux 8potrace1.15-3.el8
Oracle Linux 8pygobject3-devel3.28.3-2.el8
Oracle Linux 8python3-gobject3.28.3-2.el8
Oracle Linux 8python3-gobject-base3.28.3-2.el8
Oracle Linux 8tracker2.1.5-2.el8
Oracle Linux 8tracker-devel2.1.5-2.el8
Oracle Linux 8vte-profile0.52.4-2.el8
Oracle Linux 8vte2910.52.4-2.el8
Oracle Linux 8vte291-devel0.52.4-2.el8
Oracle Linux 8webkit2gtk32.28.4-1.el8
Oracle Linux 8webkit2gtk3-devel2.28.4-1.el8
Oracle Linux 8webkit2gtk3-jsc2.28.4-1.el8
Oracle Linux 8webkit2gtk3-jsc-devel2.28.4-1.el8
Oracle Linux 8webrtc-audio-processing0.3-9.el8
Oracle Linux 8xdg-desktop-portal1.6.0-2.el8
Oracle Linux 8xdg-desktop-portal-gtk1.6.0-1.el8
Red Hatlibwebkit2gtkno fix listed
Red Hatwebkitgtkno fix listed
Red Hatwebkitgtk-develno fix listed
Red Hatwebkitgtk-docno fix listed
Red Hatwebkitgtk3no fix listed
Red Hatwebkitgtk3-develno fix listed
Red Hatwebkitgtk3-docno fix listed
rocky 8LibRaw0.19.5-2.el8
rocky 8PackageKit1.1.12-6.el8.0.2
rocky 8PackageKit-command-not-found1.1.12-6.el8.0.2
rocky 8PackageKit-cron1.1.12-6.el8.0.2
rocky 8PackageKit-glib1.1.12-6.el8.0.2
rocky 8PackageKit-gstreamer-plugin1.1.12-6.el8.0.2
rocky 8PackageKit-gtk3-module1.1.12-6.el8.0.2
rocky 8dleyna-renderer0.6.0-3.el8
rocky 8frei0r-plugins1.6.1-7.el8
rocky 8frei0r-plugins-opencv1.6.1-7.el8
rocky 8gnome-remote-desktop0.1.8-3.el8
rocky 8gnome-session3.28.1-10.el8
rocky 8gnome-session-wayland-session3.28.1-10.el8
rocky 8gnome-session-xsession3.28.1-10.el8
rocky 8gsettings-desktop-schemas3.32.0-5.el8
rocky 8gtk-update-icon-cache3.22.30-6.el8
rocky 8gtk33.22.30-6.el8
rocky 8gtk3-devel3.22.30-6.el8
rocky 8gtk3-immodule-xim3.22.30-6.el8
rocky 8libsoup2.62.3-2.el8
rocky 8libsoup-devel2.62.3-2.el8
rocky 8pipewire0.3.6-1.el8
rocky 8pipewire-devel0.3.6-1.el8
rocky 8pipewire-doc0.3.6-1.el8
rocky 8pipewire-libs0.3.6-1.el8
rocky 8pipewire-utils0.3.6-1.el8
rocky 8pipewire0.2-devel0.2.7-6.el8
rocky 8pipewire0.2-libs0.2.7-6.el8
rocky 8potrace1.15-3.el8
rocky 8python3-gobject3.28.3-2.el8
rocky 8python3-gobject-base3.28.3-2.el8
rocky 8tracker2.1.5-2.el8
rocky 8vte-profile0.52.4-2.el8
rocky 8vte2910.52.4-2.el8
rocky 8webrtc-audio-processing0.3-9.el8
rocky 8xdg-desktop-portal-gtk1.6.0-1.el8
ubuntu 18.04webkit2gtk2.28.0-0ubuntu0.18.04.3
ubuntu 18.04-ESMwebkit2gtk2.28.0-0ubuntu0.18.04.3
ubuntu 19.10webkit2gtk2.28.0-0ubuntu0.19.10.2
ubuntu 20.04webkit2gtk2.28.0-1ubuntu2
ubuntu 20.04-ESMwebkit2gtk2.28.0-1ubuntu2
ubuntu 20.10webkit2gtk2.28.0-1ubuntu2
ubuntu 21.04webkit2gtk2.28.0-1ubuntu2
ubuntu 21.10webkit2gtk2.28.0-1ubuntu2
ubuntu 22.04webkit2gtk2.28.0-1ubuntu2
ubuntu 22.10webkit2gtk2.28.0-1ubuntu2
ubuntu 23.04webkit2gtk2.28.0-1ubuntu2
ubuntu 23.10webkit2gtk2.28.0-1ubuntu2
ubuntu 24.04webkit2gtk2.28.0-1ubuntu2

References

All 175 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.