Published: 09/06/2020 Updated: 09/01/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 790

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple icloud
apple itunes
apple safari
apple iphone os
apple watchos
apple tvos
apple ipados

The following vulnerabilities have been discovered in the webkit2gtk web engine: CVE-2020-9802 Samuel Gross discovered that processing maliciously crafted web content may lead to arbitrary code execution CVE-2020-9803 Wen Xu discovered that processing maliciously crafted web content may lead to arbitrary code execution CVE-2020-9 ...

Synopsis Moderate: OpenShift Container Platform 46 compliance-operator security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for compliance-content-container, ose-compliance-openscap-container, ose-compliance-operator-container, and ose-compliance-operator-metadata-container ...

Synopsis Moderate: GNOME security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for GNOME is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System ...

Synopsis Moderate: Red Hat Quay v333 bug fix and security update Type/Severity Security Advisory: Moderate Topic Red Hat Quay v333 is now available with bug fixes and security updatesRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring S ...

Synopsis Moderate: OpenShift Container Platform 46 compliance-operator security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for compliance-content-container, ose-compliance-openscap-container, ose-compliance-operator-container, and ose-compliance-operator-metadata-container ...

Synopsis Moderate: OpenShift Container Platform 4103 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4103 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...

Synopsis Moderate: Red Hat OpenShift Container Storage 460 security, bug fix, enhancement update Type/Severity Security Advisory: Moderate Topic Updated images are now available for Red Hat OpenShift Container Storage 460 on Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ha ...

Synopsis Important: Service Telemetry Framework 14 security update Type/Severity Security Advisory: Important Topic An update is now available for Service Telemetry Framework 14 for RHEL 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which g ...

Severity Unknown Remote Unknown Type Unknown Description AVG-1203 webkit2gtk 2282-2 2283-1 Unknown Fixed ...

Check Point Reference: CPAI-2020-4082 Date Published: 3 Dec 2023 Severity: Critical ...

This Metasploit module exploits an incorrect side-effect modeling of the 'in' operator The DFG compiler assumes that the 'in' operator is side-effect free, however the embed element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850) The type confusion can be used as addrof and fakeobj p ...

This module exploits an incorrect side-effect modeling of the 'in' operator The DFG compiler assumes that the 'in' operator is side-effect free, however the element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850) The type confusion can be used ...

Full Disclosure mailing list archives   By Date By Thread </form>    APPLE-SA-2020-05-26-10 iCloud for Windows 719   From: Apple Prod ...

Full Disclosure mailing list archives   By Date By Thread </form>    APPLE-SA-2020-05-26-4 tvOS 1345   From: Apple Product Security ...

This module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions.

msf > use exploit/osx/browser/safari_in_operator_side_effect
msf exploit(safari_in_operator_side_effect) > show targets
    ...targets...
msf exploit(safari_in_operator_side_effect) > set TARGET < target-id >
msf exploit(safari_in_operator_side_effect) > show options
    ...show and set options...
msf exploit(safari_in_operator_side_effect) > exploit

You, Apple Mac fan. Put down the homemade oat-milk latte, you need to patch a load of security bugs, too

The Register • Shaun Nichols in San Francisco • 28 May 2020

Patch Thursday is for you, Patch Tuesday is for everyone else Apple promises third, no, fourth, er, fifth time's a charm when it comes to macOS Catalina: 10.15.5 now out

Apple has alerted users about a bunch of security fixes for its software on supported versions of macOS that you ought to install as soon as you can. For Safari, there are nine CVE-listed patches in version 13.1.1. Six address malicious code execution (CVE-2020-9802, CVE-2020-9800, CVE-2020-9806, CVE-2020-9807, CVE-2020-9850, CVE-2020-9803) that can be achieved by opening a booby-trapped webpage or similar. These were found separately by Samuel Groß of Google Project Zero; Brendan Draper workin...

CVE-2020-9850

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Mailing Lists

Metasploit Modules

Recent Articles

References

Vulmon Search

About

Products

Connect