CVE-2020-3894
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and...
3.1 LowFix available
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
1.14%Up 0.9 points since Apr 14, 2021
What each source reports
NVD Score used
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.
- Record
CVE-2020-3894- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.
- Record
CVE-2020-3894- Updated
- 2026-11-02
EUVDEUVD-2020-25159 No score
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.
- Record
EUVD-2020-25159- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-86x5-95qc-wmgh
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and...
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.
- Record
GHSA-86x5-95qc-wmgh- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSV
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.
- Record
CVE-2020-3894- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-3894
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.
- Record
DEBIAN-CVE-2020-3894- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2020:4035
Red Hat Security Advisory: webkitgtk4 security, bug fix, and enhancement update
- Record
RHSA-2020:4035- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:4451
Red Hat Security Advisory: GNOME security, bug fix, and enhancement update
- Record
RHSA-2020:4451- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2020:4451
Moderate: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of Rocky Linux.
The following packages have been upgraded to a later upstream version: gnome-remote-desktop (0.1.8), pipewire (0.3.6), vte291 (0.52.4), webkit2gtk3 (2.28.4), xdg-desktop-portal (1.6.0), xdg-desktop-portal-gtk (1.6.0). (BZ#1775345, BZ#1779691, BZ#1817143, BZ#1832347, BZ#1837406)
Security Fix(es):
-
webkitgtk: Multiple security issues (CVE-2019-8625, CVE-2019-8710, CVE-2019-8720, CVE-2019-8743, CVE-2019-8764, CVE-2019-8766, CVE-2019-8769, CVE-2019-8771, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846, CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, CVE-2020-3885, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806, CVE-2020-9807, CVE-2020-9843, CVE-2020-9850, CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925, CVE-2020-10018, CVE-2020-11793)
-
gnome-settings-daemon: Rocky Enterprise Software Foundation Customer Portal password logged and passed as command line argument when user registers through GNOME control center (CVE-2020-14391)
-
LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.
- Record
RLSA-2020:4451- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-3894
A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.
- Record
UBUNTU-CVE-2020-3894- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVALSA-2020:4451 No score
Moderate: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of AlmaLinux.
The following packages have been upgraded to a later upstream version: gnome-remote-desktop (0.1.8), pipewire (0.3.6), vte291 (0.52.4), webkit2gtk3 (2.28.4), xdg-desktop-portal (1.6.0), xdg-desktop-portal-gtk (1.6.0). (BZ#1775345, BZ#1779691, BZ#1817143, BZ#1832347, BZ#1837406)
Security Fix(es):
-
webkitgtk: Multiple security issues (CVE-2019-8625, CVE-2019-8710, CVE-2019-8720, CVE-2019-8743, CVE-2019-8764, CVE-2019-8766, CVE-2019-8769, CVE-2019-8771, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846, CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, CVE-2020-3885, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806, CVE-2020-9807, CVE-2020-9843, CVE-2020-9850, CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925, CVE-2020-10018, CVE-2020-11793)
-
gnome-settings-daemon: AlmaLinux Customer Portal password logged and passed as command line argument when user registers through GNOME control center (CVE-2020-14391)
-
LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2020:4451- Updated
- 2026-11-02
OSVSUSE-SU-2022:0142-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.34.3 (bsc#1194019).
- CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when processing maliciously crafted web content.
- CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously crafted web content.
- Record
SUSE-SU-2022:0142-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0183-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.34.3 (bsc#1194019).
- CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when processing maliciously crafted web content.
- CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously crafted web content.
- Record
SUSE-SU-2022:0183-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
LibRaw-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.19.5-2.el8 | 0.19.5-2.el8 |
PackageKitAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-command-not-foundAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-cronAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-glibAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-glib-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-gstreamer-pluginAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-gtk3-moduleAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
dleyna-rendererAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.6.0-3.el8 | 0.6.0-3.el8 |
frei0r-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.6.1-7.el8 | 1.6.1-7.el8 |
Show 133 moreShow less
| Package | Affected | Fixed |
|---|---|---|
frei0r-pluginsAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.6.1-7.el8 | 1.6.1-7.el8 |
frei0r-plugins-opencvAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.6.1-7.el8 | 1.6.1-7.el8 |
gnome-remote-desktopAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.1.8-3.el8 | 0.1.8-3.el8 |
gtk-docAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.28-2.el8 | 1.28-2.el8 |
gvfsAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.36.2-10.el8 | 1.36.2-10.el8 |
libsoupAlmaLinux:8 From an advisory covering 57 CVEs |
before 2.62.3-2.el8 | 2.62.3-2.el8 |
libsoup-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 2.62.3-2.el8 | 2.62.3-2.el8 |
mutter-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.32.2-48.el8 | 3.32.2-48.el8 |
nautilusAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.1-14.el8 | 3.28.1-14.el8 |
nautilus-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.1-14.el8 | 3.28.1-14.el8 |
pipewireAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire-docAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire-libsAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire-utilsAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire0.2-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.2.7-6.el8 | 0.2.7-6.el8 |
pipewire0.2-libsAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.2.7-6.el8 | 0.2.7-6.el8 |
potraceAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.15-3.el8 | 1.15-3.el8 |
pygobject3-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.3-2.el8 | 3.28.3-2.el8 |
python3-gobjectAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.3-2.el8 | 3.28.3-2.el8 |
python3-gobject-baseAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.3-2.el8 | 3.28.3-2.el8 |
trackerAlmaLinux:8 From an advisory covering 57 CVEs |
before 2.1.5-2.el8 | 2.1.5-2.el8 |
tracker-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 2.1.5-2.el8 | 2.1.5-2.el8 |
vte-profileAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.52.4-2.el8 | 0.52.4-2.el8 |
vte291AlmaLinux:8 From an advisory covering 57 CVEs |
before 0.52.4-2.el8 | 0.52.4-2.el8 |
vte291-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.52.4-2.el8 | 0.52.4-2.el8 |
webrtc-audio-processingAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3-9.el8 | 0.3-9.el8 |
xdg-desktop-portal-gtkAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.6.0-1.el8 | 1.6.0-1.el8 |
webkit2gtkDebian:12 |
before 2.28.0-2 | 2.28.0-2 |
webkit2gtkDebian:13 |
before 2.28.0-2 | 2.28.0-2 |
webkit2gtkDebian:14 |
before 2.28.0-2 | 2.28.0-2 |
wpewebkitDebian:12 |
before 2.28.0-1 | 2.28.0-1 |
wpewebkitDebian:13 |
before 2.28.0-1 | 2.28.0-1 |
wpewebkitDebian:14 |
before 2.28.0-1 | 2.28.0-1 |
webkit2gtkDebian:10 From an advisory covering 9 CVEs |
before 2.28.2-2~deb10u1, plus listed versions 2.24.2-12.24.2-22.24.3-12.24.3-1~bpo10+12.24.3-1~bpo9+1 Show 45 moreShow less2.24.3-1~deb10u12.24.4-12.24.4-1~bpo10+12.24.4-1~bpo9+12.24.4-1~deb10u12.25.1-12.25.2-12.25.4-12.25.92-12.26.0-12.26.1-12.26.1-22.26.1-32.26.1-3~bpo10+12.26.1-3~bpo9+12.26.1-3~bpo9+22.26.1-3~deb10u12.26.2-12.26.2-1~bpo9+12.26.2-1~deb10+12.26.3-12.26.3-1~bpo10+12.26.3-1~bpo9+12.26.3-1~deb10u12.26.4-12.26.4-1~bpo9+12.26.4-1~bpo9+22.26.4-1~bpo9+32.26.4-1~deb10u12.26.4-1~deb10u22.26.4-1~deb10u32.27.1-12.27.2-12.27.3-12.27.4-12.27.90-12.27.91-12.28.0-12.28.0-22.28.0-2~bpo10+12.28.1-12.28.1-22.28.1-2~bpo10+12.28.2-12.28.2-2~bpo10+1 |
2.28.2-2~deb10u1 |
webkitgtk4Red Hat:enterprise_linux:7::client From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-jscRed Hat:enterprise_linux:7::client From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-develRed Hat:enterprise_linux:7::client From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-docRed Hat:enterprise_linux:7::client From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-jsc-develRed Hat:enterprise_linux:7::client From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4Red Hat:enterprise_linux:7::computenode From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-jscRed Hat:enterprise_linux:7::computenode From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-develRed Hat:enterprise_linux:7::computenode From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-docRed Hat:enterprise_linux:7::computenode From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-jsc-develRed Hat:enterprise_linux:7::computenode From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4Red Hat:enterprise_linux:7::server From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-develRed Hat:enterprise_linux:7::server From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-jscRed Hat:enterprise_linux:7::server From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-jsc-develRed Hat:enterprise_linux:7::server From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-docRed Hat:enterprise_linux:7::server From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4Red Hat:enterprise_linux:7::workstation From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-develRed Hat:enterprise_linux:7::workstation From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-jscRed Hat:enterprise_linux:7::workstation From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-jsc-develRed Hat:enterprise_linux:7::workstation From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkitgtk4-docRed Hat:enterprise_linux:7::workstation From an advisory covering 104 CVEs |
before 0:2.28.2-2.el7 | 0:2.28.2-2.el7 |
webkit2gtk3Red Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-develRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-jscRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
gnome-settings-daemonRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:3.32.0-11.el8 | 0:3.32.0-11.el8 |
gnome-settings-daemon-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:3.32.0-11.el8 | 0:3.32.0-11.el8 |
gnome-settings-daemon-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:3.32.0-11.el8 | 0:3.32.0-11.el8 |
LibRawRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-samples-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-debuginfoRed Hat:enterprise_linux:8::crb From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-debugsourceRed Hat:enterprise_linux:8::crb From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-develRed Hat:enterprise_linux:8::crb From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-samples-debuginfoRed Hat:enterprise_linux:8::crb From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
dleyna-rendererRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.6.0-3.el8 | 0:0.6.0-3.el8 |
frei0r-pluginsRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.6.1-7.el8 | 0:1.6.1-7.el8 |
gnome-remote-desktopRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.1.8-3.el8 | 0:0.1.8-3.el8 |
gnome-sessionRocky Linux:8 From an advisory covering 57 CVEs |
before 0:3.28.1-10.el8 | 0:3.28.1-10.el8 |
gsettings-desktop-schemasRocky Linux:8 From an advisory covering 57 CVEs |
before 0:3.32.0-5.el8 | 0:3.32.0-5.el8 |
gtk3Rocky Linux:8 From an advisory covering 57 CVEs |
before 0:3.22.30-6.el8 | 0:3.22.30-6.el8 |
LibRawRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
libsoupRocky Linux:8 From an advisory covering 57 CVEs |
before 0:2.62.3-2.el8 | 0:2.62.3-2.el8 |
PackageKitRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.1.12-6.el8 | 0:1.1.12-6.el8 |
PackageKitRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.1.12-6.el8.0.2 | 0:1.1.12-6.el8.0.2 |
pipewire0.2Rocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.2.7-6.el8 | 0:0.2.7-6.el8 |
pipewireRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.3.6-1.el8 | 0:0.3.6-1.el8 |
potraceRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.15-3.el8 | 0:1.15-3.el8 |
pygobject3Rocky Linux:8 From an advisory covering 57 CVEs |
before 0:3.28.3-2.el8 | 0:3.28.3-2.el8 |
trackerRocky Linux:8 From an advisory covering 57 CVEs |
before 0:2.1.5-2.el8 | 0:2.1.5-2.el8 |
vte291Rocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.52.4-2.el8 | 0:0.52.4-2.el8 |
webrtc-audio-processingRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.3-9.el8 | 0:0.3-9.el8 |
xdg-desktop-portal-gtkRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.6.0-1.el8 | 0:1.6.0-1.el8 |
webkit2gtk3SUSE:HPE Helion OpenStack 8 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:OpenStack Cloud 8 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:OpenStack Cloud 9 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:OpenStack Cloud Crowbar 8 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 72 CVEs |
before 2.34.3-2.82.1 | 2.34.3-2.82.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15-LTSS From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
webkit2gtk3SUSE:Enterprise Storage 6 From an advisory covering 53 CVEs |
before 2.34.3-3.92.1 | 2.34.3-3.92.1 |
qtwebkit-opensource-srcUbuntu:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1 |
None known |
webkit2gtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1 |
None known |
qtwebkit-sourceUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 |
None known |
webkitgtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1 |
None known |
webkit2gtkUbuntu:18.04:LTS |
before 2.28.0-0ubuntu0.18.04.3, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 22 moreShow less2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.12.22.5-0ubuntu0.18.04.12.22.6-0ubuntu0.18.04.12.24.1-0ubuntu0.18.04.12.24.2-0ubuntu0.18.04.12.24.4-0ubuntu0.18.04.12.26.1-0ubuntu0.18.04.12.26.2-0ubuntu0.18.04.12.26.3-0ubuntu0.18.04.12.26.4-0ubuntu0.18.04.1 |
2.28.0-0ubuntu0.18.04.3 |
qtwebkit-opensource-srcUbuntu:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1 |
None known |
qtwebkit-sourceUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu13 |
None known |
webkitgtkUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3 |
None known |
webkit2gtkUbuntu:20.04:LTS |
before 2.28.0-1ubuntu2, plus listed versions 2.26.1-32.26.2-12.26.3-1ubuntu22.26.4-1ubuntu1 |
2.28.0-1ubuntu2 |
qtwebkit-opensource-srcUbuntu:20.04:LTS |
All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1 |
None known |
qtwebkit-opensource-srcUbuntu:22.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1 |
None known |
qtwebkit-opensource-srcUbuntu:24.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-3894 is a low vulnerability (CVSS 3.1) in Apple Icloud, published April 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in webkit2gtk 2.28.0-2.
References
support.apple.com/HT211102
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-3894
security.gentoo.org/glsa/202006-08
debian.org/security/2020/dsa-4681
packetstormsecurity.com/files/157378/WebKit-AudioArray-allocate-Data-Race-Out-Of-Bounds-Access.html
openwall.com/lists/oss-security/2020/04/27/3
github.com/advisories/GHSA-86x5-95qc-wmgh
errata.almalinux.org/8/ALSA-2020-4451.html
vulners.com/cve/CVE-2019-8625
security-tracker.debian.org/tracker/CVE-2020-3894
access.redhat.com/errata/RHSA-2020:4035
bugzilla.redhat.com/show_bug.cgi?id=1667409
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4035.json
cve.org/CVERecord?id=CVE-2019-6237
webkitgtk.org/security/WSA-2019-0003.html
cisa.gov/known-exploited-vulnerabilities-catalog
errata.rockylinux.org/RLSA-2020:4451
suse.com/support/update/announcement/2022/suse-su-20220142-1
bugzilla.suse.com/1194019
ubuntu.com/security/CVE-2020-3894
This page doesn't list everything
Left out here: 494 references. The JSON record has them.