PT-2020-6106 · Apple+7 · Safari+16

Samuel Groß · Published 2020-05-20 · Updated 2025-11-12 · CVE-2020-9802

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apple macOS versions prior to 10.15.3 Apple tvOS versions prior to 13.3.1 Apple watchOS versions prior to 6.1.2 Apple Safari versions prior to 13.1.1 Apple iTunes versions prior to 12.10.7 for Windows Apple iCloud for Windows versions prior to 11.2 Apple iCloud for Windows versions prior to 7.19 WebKitGTK versions prior to 2.28.3 WPE WebKit versions prior to 2.28.3 openSUSE libjavascriptcoregtk-4 0-18-2.32.4-1.1

Description A logic flaw exists within the WebKit engine, potentially allowing a remote attacker to execute arbitrary code by processing maliciously crafted web content. This issue affects multiple Apple products, including macOS, tvOS, watchOS, Safari, iTunes, and iCloud for Windows. The vulnerability is related to improper restrictions and can be exploited through specially designed web pages. The issue has been actively exploited. The vulnerability affects WebKitGTK and WPE WebKit, potentially leading to cross-site scripting, denial of service, and arbitrary code execution.

Recommendations Update Apple macOS to version 10.15.3 or later. Update Apple tvOS to version 13.3.1 or later. Update Apple watchOS to version 6.1.2 or later. Update Apple Safari to version 13.1.1 or later. Update Apple iTunes to version 12.10.7 or later for Windows. Update Apple iCloud for Windows to version 11.2 or later. Update Apple iCloud for Windows to version 7.19 or later. Update WebKitGTK to version 2.28.3 or later. Update WPE WebKit to version 2.28.3 or later. Update the libjavascriptcoregtk-4 0-18-2.32.4-1.1 package on openSUSE. Run sudo pro fix USN-4422-1 to address the vulnerability in Ubuntu systems.

Exploit

Fix

Weakness Enumeration

CWE-841

Related Identifiers

ALSA-2020:4451

BDU:2021-03028

CESA-2020_4451

CVE-2020-9802

DSA-4724-1

MGASA-2020-0317

OPENSUSE-SU-2020:1064-1

OPENSUSE-SU-2020_1064-1

OPENSUSE-SU-2022:0182-1

OPENSUSE-SU-2022_0182-1

OPENSUSE-SU-2022_0182-2

OPENSUSE-SU-2024:11506-1

RHSA-2020:4451

RHSA-2020_4451

RHSA-2025:10364

RLSA-2020:4451

SUSE-SU-2020:1990-1

SUSE-SU-2020:1992-1

SUSE-SU-2020:2069-1

SUSE-SU-2022:0142-1

SUSE-SU-2022:0182-1

SUSE-SU-2022:0182-2

SUSE-SU-2022:0183-1

USN-4422-1

Affected Products

Almalinux

Centos

Linuxmint

Red Hat

Rocky Linux

Safari

Suse

Ubuntu

Webkit

Icloud For Windows

Ios

Ipados

Itunes

Itunes For Windows

Apple Macos

Tvos

Watchos

References · 412

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/safari_in_operator_side_effect.rb · Exploit
• 🔥 https://github.com/BadAccess11/CVE-2019-8601 · Exploit
• 🔥❌ https://github.com/PeterMxx/ps4_8.00_vuln_poc · Exploit, Deleted
• https://ubuntu.com/security/CVE-2020-9843 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4724-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0182-2 · Vendor Advisory
• https://support.apple.com/HT211177 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4451 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1992-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9803 · Vendor Advisory
• https://support.apple.com/HT211178 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13753 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-9802 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-9802 · Vendor Advisory
• https://support.apple.com/HT211171 · Vendor Advisory