PT-2020-6091 · Apple+1 · Safari+11

Cc · Published 2020-11-12 · Updated 2024-06-15 · CVE-2020-9947

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions watchOS versions prior to 7.0 iOS versions prior to 14.0 iPadOS versions prior to 14.0 iTunes for Windows versions prior to 12.10.9 iCloud for Windows versions prior to 11.5 tvOS versions prior to 14.0 Safari versions prior to 14.0 macOS Big Sur versions prior to 11.0.1 watchOS versions prior to 7.1 iOS versions prior to 14.2 iPadOS versions prior to 14.2 tvOS versions prior to 14.2 iTunes for Windows versions prior to 12.11 Safari versions prior to 14.0.1

Description A use after free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. The issue is related to the WebKit module's memory usage after it has been freed, which can be exploited by a remote attacker using malicious web content.

Recommendations For watchOS versions prior to 7.0, update to watchOS 7.0 or later. For iOS versions prior to 14.0, update to iOS 14.0 or later. For iPadOS versions prior to 14.0, update to iPadOS 14.0 or later. For iTunes for Windows versions prior to 12.10.9, update to iTunes for Windows 12.10.9 or later. For iCloud for Windows versions prior to 11.5, update to iCloud for Windows 11.5 or later. For tvOS versions prior to 14.0, update to tvOS 14.0 or later. For Safari versions prior to 14.0, update to Safari 14.0 or later. For macOS Big Sur versions prior to 11.0.1, update to macOS Big Sur 11.0.1 or later. For watchOS versions prior to 7.1, update to watchOS 7.1 or later. For iOS versions prior to 14.2, update to iOS 14.2 or later. For iPadOS versions prior to 14.2, update to iPadOS 14.2 or later. For tvOS versions prior to 14.2, update to tvOS 14.2 or later. For iTunes for Windows versions prior to 12.11, update to iTunes for Windows 12.11 or later. For Safari versions prior to 14.0.1, update to Safari 14.0.1 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2021-02980

CVE-2020-9947

DSA-4797-1

DSA-4797-2

MGASA-2021-0181

OPENSUSE-SU-2022:0182-1

OPENSUSE-SU-2022_0182-1

OPENSUSE-SU-2022_0182-2

OPENSUSE-SU-2024:11506-1

RHSA-2025:10364

SUSE-SU-2021:1990-1

SUSE-SU-2022:0142-1

SUSE-SU-2022:0182-1

SUSE-SU-2022:0182-2

SUSE-SU-2022:0183-1

ZDI-20-1390

Affected Products

Apple Macos

Safari

Suse

Webkit

Icloud For Windows

Ios

Ipados

Itunes

Itunes For Windows

Macos Big Sur

Tvos

Watchos

References · 234

• 🔥❌ https://github.com/PeterMxx/ps4_8.00_vuln_poc · Exploit, Deleted
• https://support.apple.com/en-us/HT211952 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1990-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202104-03 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9947 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0142-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9947 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:0182-2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11506-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02980 · Security Note
• https://support.apple.com/en-us/HT211844 · Vendor Advisory
• https://support.apple.com/en-us/HT211850 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-1390 · Security Note
• https://osv.dev/vulnerability/DSA-4797-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0181 · Vendor Advisory