PT-2020-20913 · Apple · Ios+4

Josh Parnham + 1 · Published 2020-11-12 · Updated 2023-08-27 · CVE-2020-9977

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS Big Sur version 11.0.1 and earlier iOS versions prior to 14.0 iPadOS versions prior to 14.0

Description A validation issue existed in the entitlement verification, which was addressed with improved validation of the process entitlement. This issue allowed a malicious application to determine a user's open tabs in Safari.

Recommendations For macOS Big Sur versions prior to 11.0.1, update to version 11.0.1 or later. For iOS versions prior to 14.0, update to version 14.0 or later. For iPadOS versions prior to 14.0, update to version 14.0 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-9977

Affected Products

Apple Macos

Safari

Ios

Ipados

Macos Big Sur

References · 11

• https://osv.dev/vulnerability/CVE-2020-9977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9977 · Security Note
• https://support.apple.com/en-us/HT211931 · Vendor Advisory
• https://support.apple.com/en-us/HT211850 · Vendor Advisory
• https://t.me/cibsecurity/17274 · Telegram Post
• https://t.me/cvenotify/6866 · Telegram Post
• https://t.me/cvenotify/6757 · Telegram Post
• https://twitter.com/joshparnham/status/1695775688442384445 · Twitter Post
• https://support.apple.com/en-us/102846 · Note
• http://seclists.org/fulldisclosure/2020/Dec/32 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9977 · Note