VulnerabilityModified
CVE-2020-9932
A memory corruption issue was addressed with improved validation.
HIGH 8.8EPSS 1.17%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A memory corruption issue was addressed with improved validation. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, tvOS 13. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.17% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- apple/safari · apple/ipados · apple/iphone os · apple/tvos
- Source
- product-security@apple.com
References
- https://support.apple.com/en-us/HT210603Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210604Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210605Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210603Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210604Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210605Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.