MEDIUM
webkitgtk: Incorrect processing of file URLs
Published Apr 1, 2020
4.3
MEDIUMCVSS 3.1
EPSS 1.71%
Description
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A file URL may be incorrectly processed.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<Safari 13.1
- Version
-
- Version unspecifiedStatusaffectedConstraints<iCloud for Windows 10.9.3
- Version
-
- Version unspecifiedStatusaffectedConstraints<iCloud for Windows 7.18
- Version
-
- Version unspecifiedStatusaffectedConstraints<iOS 13.4 and iPadOS 13.4
- Version
-
- Version unspecifiedStatusaffectedConstraints<iTunes for Windows 12.10.5
- Version
-
- Version unspecifiedStatusaffectedConstraints<tvOS 13.4
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apple | Safari | n/a |
| ||||||
| Apple | iCloud for Windows | n/a |
| ||||||
| Apple | iCloud for Windows (Legacy) | n/a |
| ||||||
| Apple | iOS | n/a |
| ||||||
| Apple | iTunes for Windows | n/a |
| ||||||
| Apple | tvOS | n/a |
|
No data.
Red Hat Enterprise Linux 7
webkitgtk4-0:2.28.2-2.el7
Fixed · RHSA-2020:4035
Red Hat Enterprise Linux 8
webkit2gtk3-0:2.28.4-1.el8
Fixed · RHSA-2020:4451
Red Hat Enterprise Linux 6
webkitgtk
Out of support scope
Red Hat Enterprise Linux 7
webkitgtk3
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | webkitgtk4-0:2.28.2-2.el7 | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux 8 | webkit2gtk3-0:2.28.4-1.el8 | Fixed | RHSA-2020:4451 |
| Red Hat Enterprise Linux 6 | webkitgtk | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | webkitgtk3 | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (11)
- https://access.redhat.com/security/cve/CVE-2020-3885 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1876462 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2020-3885
- https://support.apple.com/HT211101 x_refsource_MISCRelease NotesVendor Advisory
- https://support.apple.com/HT211102 x_refsource_MISCRelease NotesVendor Advisory
- https://support.apple.com/HT211104 x_refsource_MISCRelease NotesVendor Advisory
- https://support.apple.com/HT211105 x_refsource_MISCRelease NotesVendor Advisory
- https://support.apple.com/HT211106 x_refsource_MISCRelease NotesVendor Advisory
- https://support.apple.com/HT211107 x_refsource_MISCRelease NotesVendor Advisory
- https://webkitgtk.org/security/WSA-2020-0005.html
- https://www.cve.org/CVERecord?id=CVE-2020-3885
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-3885 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1876462 | Issue Tracking | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-3885 | ||
| https://support.apple.com/HT211101 | x_refsource_MISCRelease NotesVendor Advisory | |
| https://support.apple.com/HT211102 | x_refsource_MISCRelease NotesVendor Advisory | |
| https://support.apple.com/HT211104 | x_refsource_MISCRelease NotesVendor Advisory | |
| https://support.apple.com/HT211105 | x_refsource_MISCRelease NotesVendor Advisory | |
| https://support.apple.com/HT211106 | x_refsource_MISCRelease NotesVendor Advisory | |
| https://support.apple.com/HT211107 | x_refsource_MISCRelease NotesVendor Advisory | |
| https://webkitgtk.org/security/WSA-2020-0005.html | ||
| https://www.cve.org/CVERecord?id=CVE-2020-3885 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apple
Published Apr 1, 2020
Updated Aug 4, 2024
Reserved Dec 18, 2019
Link CVE-2020-3885
CISA Vulnrichment
Updated n/a