CVE-2020-9951

high-risk
Published 2020-10-16

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.

Do I need to act?

~
2.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (9)

Webkitgtk\+

Affected Vendors

Debian Apple Webkit

References (26)

Mailing List http://seclists.org/fulldisclosure/2020/Nov/18
Mailing List http://seclists.org/fulldisclosure/2020/Nov/19
Mailing List http://seclists.org/fulldisclosure/2020/Nov/20
Mailing List http://seclists.org/fulldisclosure/2020/Nov/22
Mailing List http://www.openwall.com/lists/oss-security/2020/11/23/3
Third Party Advisory https://security.gentoo.org/glsa/202012-10
Release Notes https://support.apple.com/HT211845
Vendor Advisory https://support.apple.com/kb/HT211843
Vendor Advisory https://support.apple.com/kb/HT211844
Vendor Advisory https://support.apple.com/kb/HT211850
Vendor Advisory https://support.apple.com/kb/HT211935
Vendor Advisory https://support.apple.com/kb/HT211952
Third Party Advisory https://www.debian.org/security/2020/dsa-4797
Mailing List http://seclists.org/fulldisclosure/2020/Nov/18
Mailing List http://seclists.org/fulldisclosure/2020/Nov/19
Mailing List http://seclists.org/fulldisclosure/2020/Nov/20
Mailing List http://seclists.org/fulldisclosure/2020/Nov/22
Mailing List http://www.openwall.com/lists/oss-security/2020/11/23/3
Third Party Advisory https://security.gentoo.org/glsa/202012-10
Release Notes https://support.apple.com/HT211845
and 6 more references
50
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 5/34 · Minimal
Exposure 15/34 · Moderate