CVE-2019-8720
WebKitGTK Memory Corruption Vulnerability
Description
CVE-2019-8720 is a memory corruption vulnerability in WebKitGTK that allows an attacker to perform remote code execution. By crafting malicious web content, an attacker can trigger a memory corruption condition in the WebKit rendering engine, leading to arbitrary code execution on systems using WebKitGTK-based browsers or applications. CISA has confirmed active exploitation of CVE-2019-8720 and included it in the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS percentile of 91.9%, this vulnerability represents a significant threat to Linux and GNOME-based systems that rely on WebKitGTK for web content rendering.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| webkitgtk | webkitgtk | < 2.26.0 |
| wpewebkit | wpe webkit | < 2.26.0 |
| redhat | codeready linux builder | 8.0 |
| redhat | codeready linux builder eus | 8.4; 8.6 |
| redhat | codeready linux builder for arm64 eus | 8.0; 8.4; 8.6 |
| redhat | codeready linux builder for ibm z systems eus | 8.0; 8.4; 8.6 |
| redhat | codeready linux builder for power little endian eus | 8.0; 8.4; 8.6 |
| redhat | enterprise linux | 8.0 |
| redhat | enterprise linux desktop | 7.0 |
| redhat | enterprise linux eus | 8.4; 8.6 |
| redhat | enterprise linux for arm64 eus | 8.6 |
| redhat | enterprise linux for ibm z systems | 7.0; 8.0 |
| redhat | enterprise linux for ibm z systems eus | 8.4; 8.6 |
| redhat | enterprise linux for power big endian | 7.0 |
| redhat | enterprise linux for power little endian | 7.0; 8.0 |
| redhat | enterprise linux for power little endian eus | 8.4; 8.6 |
| redhat | enterprise linux for scientific computing | 7.0 |
| redhat | enterprise linux server | 7.0 |
| redhat | enterprise linux server aus | 8.4; 8.6 |
| redhat | enterprise linux server for power little endian update services for sap solutions | 8.4; 8.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1876611(Issue Tracking, Third Party Advisory)
- https://webkitgtk.org/security/WSA-2019-0005.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8720(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CWE-787 describes a weakness where a product writes data past the end or before the beginning of the intended buffer, potentially leading to data corruption, crashes, or code execution. In CVE-2019-8720, WebKitGTK's rendering engine writes beyond buffer boundaries when processing crafted web content, enabling an attacker to corrupt memory structures and achieve arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2019-8720 is a memory corruption vulnerability in WebKitGTK that enables remote code execution through processing of malicious web content. The attack is network-based and can be triggered when a user navigates to a crafted web page using any browser or application built on WebKitGTK. No authentication or special privileges are required, and user interaction is limited to visiting the malicious page. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the process rendering the web content. On Linux systems where WebKitGTK is commonly used, this could include the GNOME Web browser (Epiphany), email clients that render HTML content, and other GTK-based applications that display web content. The EPSS percentile of 91.9% indicates a high probability of exploitation activity. The widespread use of WebKitGTK across Linux distributions means the attack surface extends beyond browsers to any application that embeds WebKitGTK for content rendering.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-8720 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 91.9% reflects significant real-world exploitation activity against systems using WebKitGTK. Memory corruption vulnerabilities in web rendering engines are among the most valuable exploits, as they provide remote code execution through one of the most common user activities — web browsing. While WebKitGTK has a smaller user base than Chrome or Safari's WebKit, it is widely deployed on Linux systems and embedded devices, creating a meaningful attack surface particularly in enterprise Linux environments and IoT devices that use GTK-based interfaces.
Remediation
- Update WebKitGTK to the latest available version that contains the fix for CVE-2019-8720. On most Linux distributions, this is available through the standard package manager (apt, dnf, pacman, etc.).
- Ensure automatic security updates are enabled for WebKitGTK packages on all Linux systems, as WebKitGTK is often updated independently of the browser applications that use it.
- Identify all applications in your environment that depend on WebKitGTK for web content rendering — this includes not just browsers like GNOME Web, but also email clients, help viewers, and custom applications using the WebKitGTK widget.
- Implement web content filtering at the network level to block known malicious domains that may serve exploits targeting WebKitGTK vulnerabilities.
- Consider deploying application sandboxing (such as Flatpak or Snap confinement) for WebKitGTK-based applications to limit the impact of successful exploitation by restricting the process's access to system resources.
Technical Details
CVE-2019-8720 is a memory corruption vulnerability in WebKitGTK, the GTK port of the WebKit rendering engine used across Linux distributions and GNOME-based desktop environments. The vulnerability involves improper handling of memory during web content processing, where crafted HTML, CSS, or JavaScript content can trigger an out-of-bounds write condition in the rendering pipeline. This allows an attacker to corrupt adjacent memory structures, including function pointers and object metadata, in a controlled manner that enables redirection of program execution to attacker-supplied code. The attack surface is broad because WebKitGTK is not only used by dedicated web browsers but is also embedded as a widget in numerous GTK-based applications for rendering HTML content — including help systems, email clients, RSS readers, and custom enterprise applications. The remote code execution vector means exploitation can occur without any prior access to the target system, requiring only that the victim process loads attacker-controlled web content.
Frequently Asked Questions
Is CVE-2019-8720 being actively exploited?
Yes, CVE-2019-8720 is being actively exploited. CISA has included it in the Known Exploited Vulnerabilities catalog, and its EPSS percentile of 91.9% confirms significant exploitation activity targeting systems running WebKitGTK.
What products are affected by CVE-2019-8720?
CVE-2019-8720 affects WebKitGTK, the GTK port of the WebKit rendering engine. This impacts GNOME Web (Epiphany), any GTK-based application that uses WebKitGTK for rendering web content, and Linux distributions that include WebKitGTK as a system component.
How do I fix CVE-2019-8720?
Update WebKitGTK through your Linux distribution's package manager to the latest available version. Ensure automatic security updates are enabled. Identify all applications in your environment that depend on WebKitGTK and verify they use the patched version.
How severe is CVE-2019-8720?
CVE-2019-8720 is a serious memory corruption vulnerability with an EPSS percentile of 91.9%. It enables remote code execution through crafted web content, and the broad use of WebKitGTK across Linux applications means the attack surface extends beyond just web browsers to any application that renders HTML content.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.