CVE-2020-13753

The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.

• CWE-20

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00074.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GER2ATKZXDHM7FFYJH67ZPNZZX5VOUVM/
• https://security.gentoo.org/glsa/202007-11Third Party Advisory
• https://trac.webkit.org/changeset/262368/webkitPatch, Vendor Advisory
• https://usn.ubuntu.com/4422-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4724Third Party Advisory
• https://www.openwall.com/lists/oss-security/2020/07/10/1Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00074.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GER2ATKZXDHM7FFYJH67ZPNZZX5VOUVM/
• https://security.gentoo.org/glsa/202007-11Third Party Advisory
• https://trac.webkit.org/changeset/262368/webkitPatch, Vendor Advisory
• https://usn.ubuntu.com/4422-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4724Third Party Advisory
• https://www.openwall.com/lists/oss-security/2020/07/10/1Mailing List, Third Party Advisory

Published

Jul 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13748Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13749Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-1375An elevation of privilege vulnerability exists when Windows …7.8
• CVE-2020-13750Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13751Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13752Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13754hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger…6.7
• CVE-2020-13756Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontr…9.8
• CVE-2020-13757Python-RSA before 4.1 ignores leading '\0' bytes during decr…7.5
• CVE-2020-13758modules/security/classes/general.post_filter.php/post_filter…6.1
• CVE-2020-13759rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allow…7.5
• CVE-2020-1376<p>An elevation of privilege vulnerability exists in the way…7.8