CVE-2020-9947
published 2020-12-08CVE-2020-9947: A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9…
PriorityP348high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.63%
73.5th percentile
A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | icloud | < 11.5.0 | 11.5.0 |
| apple | icloud_for_windows | >= unspecified < 11.5 | 11.5 |
| apple | ios_and_ipados | >= unspecified < 14.0 | 14.0 |
| apple | ipados | < 14.0 | 14.0 |
| apple | iphone_os | < 14.0 | 14.0 |
| apple | itunes | >= 12.0.0 < 12.10.9 | 12.10.9 |
| apple | itunes_12.10.9_for_windows | — | — |
| apple | itunes_for_windows | >= unspecified < 12.10 | 12.10 |
| apple | safari | < 14.0 | 14.0 |
| apple | safari | >= unspecified < 14.0 | 14.0 |
| apple | tvos | < 14.0 | 14.0 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < 14.0 | 14.0 |
| apple | watchos | < 7.0 | 7.0 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < 7.0 | 7.0 |
| debian | webkit2gtk | < webkit2gtk 2.30.1-1 (bookworm) | webkit2gtk 2.30.1-1 (bookworm) |
| debian | wpewebkit | < webkit2gtk 2.30.1-1 (bookworm) | webkit2gtk 2.30.1-1 (bookworm) |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xvmv-wg5c-7x3w: A use after free issue was addressed with improved memory management
ghsa_unreviewed·2022-05-24
CVE-2020-9947 [HIGH] CWE-416 GHSA-xvmv-wg5c-7x3w: A use after free issue was addressed with improved memory management
A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
OSV
CVE-2020-9947: A use after free issue was addressed with improved memory management
osv·2020-12-08·CVSS 8.8
CVE-2020-9947 [HIGH] CVE-2020-9947: A use after free issue was addressed with improved memory management
A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
Red Hat
webkitgtk: use after free issue may lead to arbitrary code execution
vendor_redhat·2021-03-22·CVSS 8.8
CVE-2020-9947 [HIGH] CWE-416 webkitgtk: use after free issue may lead to arbitrary code execution
webkitgtk: use after free issue may lead to arbitrary code execution
A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.0. Processing maliciously crafted web content may lead to arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Out of support scope
Package: webkitgtk3 (Red Hat Enterprise Linux 7) - Out of support scope
Package: webkit2gtk3 (
Apple
CVE-2020-9947: iTunes 12.10.9 for Windows
vendor_apple·2020-09-16·CVSS 8.8
CVE-2020-9947 [HIGH] CVE-2020-9947: iTunes 12.10.9 for Windows
Apple Security Update: About the security content of iTunes 12.10.9 for Windows
Product: iTunes 12.10.9 for Windows
CVE: CVE-2020-9947
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
Apple
CVE-2020-9947: tvOS 14.0
vendor_apple·2020-09-16·CVSS 8.8
CVE-2020-9947 [HIGH] CVE-2020-9947: tvOS 14.0
Apple Security Update: About the security content of tvOS 14.0
Product: tvOS
Version: 14.0
CVE: CVE-2020-9947
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
Apple
CVE-2020-9947: watchOS 7.0
vendor_apple·2020-09-16·CVSS 8.8
CVE-2020-9947 [HIGH] CVE-2020-9947: watchOS 7.0
Apple Security Update: About the security content of watchOS 7.0
Product: watchOS
Version: 7.0
CVE: CVE-2020-9947
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
Debian
CVE-2020-9947: webkit2gtk - A use after free issue was addressed with improved memory management. This issue...
vendor_debian·2020·CVSS 8.8
CVE-2020-9947 [HIGH] CVE-2020-9947: webkit2gtk - A use after free issue was addressed with improved memory management. This issue...
A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
Scope: local
bookworm: resolved (fixed in 2.30.1-1)
bullseye: resolved (fixed in 2.30.1-1)
forky: resolved (fixed in 2.30.1-1)
sid: resolved (fixed in 2.30.1-1)
trixie: resolved (fixed in 2.30.1-1)
No detection rules found.
No public exploits indexed.
Qualys
Prevent Pegasus Spyware Attacks with VMDR | Qualys
blogs_qualys·2021-07-23
Prevent Pegasus Spyware Attacks with VMDR | Qualys
#### Table of Contents
- Attack Vectors and Impact of Pegasus Spyware
- VMDR for Mobile Devices Helps Protect from Pegasus Spyware
- Get Started Now
Pegasus spyware is in the news, and it has been used to target devices of critical people from different sectors and countries including journalists, activists, politicians, and business executives. It has been said that a leaked list of 50,000 phone numbers of potential surveillance targets was obtained by Paris-based journalism nonprofit Forbidden Stories and Amnesty International.
Pegasus spyware is a surveillance software created by Israeli cyber intelligence firm NSO Group. Pegasus is one such software developed to gain access to your phone without consent and gather personal and sensitive information and deliver it to the user spying
Qualys
Protect your Devices from Pegasus Spyware using VMDR for Mobile Devices’ Proactive Approach
blogs_qualys·2021-07-23
Protect your Devices from Pegasus Spyware using VMDR for Mobile Devices’ Proactive Approach
## Table of Contents
Attack Vectors and Impact of Pegasus Spyware
VMDR for Mobile Devices Helps Protect from Pegasus Spyware
Get Started Now
Pegasus spyware is in the news, and it has been used to target devices of critical people from different sectors and countries including journalists, activists, politicians, and business executives. It has been said that a leaked list of 50,000 phone numbers of potential surveillance targets was obtained by Paris-based journalism nonprofit Forbidden Stories and Amnesty International.
Pegasus spyware is a surveillance software created by Israeli cyber intelligence firm NSO Group. Pegasus is one such software developed to gain access to your phone without consent and gather personal and sensitive information and deliver it to the user spying on you
http://www.openwall.com/lists/oss-security/2021/03/22/1https://security.gentoo.org/glsa/202104-03https://support.apple.com/en-us/HT211843https://support.apple.com/en-us/HT211844https://support.apple.com/en-us/HT211845https://support.apple.com/en-us/HT211850https://support.apple.com/en-us/HT211935https://support.apple.com/en-us/HT211952http://www.openwall.com/lists/oss-security/2021/03/22/1https://security.gentoo.org/glsa/202104-03https://support.apple.com/en-us/HT211843https://support.apple.com/en-us/HT211844https://support.apple.com/en-us/HT211845https://support.apple.com/en-us/HT211850https://support.apple.com/en-us/HT211935https://support.apple.com/en-us/HT211952
2020-12-08
Published