var-202006-1650
Vulnerability from variot
A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.1. A malicious process may cause Safari to launch an application. This vulnerability allows local attackers to escalate privileges on affected installations of Apple Safari. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of symbolic links. The issue results from the improper validation of symbolic links prior to performing operations on them. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the kernel. Apple Safari is a web browser of Apple (Apple), the default browser included with Mac OS X and iOS operating systems. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2020-05-26-7 Safari 13.1.1
Safari 13.1.1 is now available and addresses the following:
Safari Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: A malicious process may cause Safari to launch an application Description: A logic issue was addressed with improved restrictions. CVE-2020-9801: @jinmo123, @setuid0x0_, and @insu_yun_en of @SSLab_Gatech working with Trend Micro’s Zero Day Initiative
WebKit Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue was addressed with improved restrictions. CVE-2020-9802: Samuel Groß of Google Project Zero
WebKit Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue was addressed with improved restrictions. CVE-2020-9805: an anonymous researcher
WebKit Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2020-9800: Brendan Draper (@6r3nd4n) working with Trend Micro Zero Day Initiative
WebKit Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved state management. CVE-2020-9806: Wen Xu of SSLab at Georgia Tech CVE-2020-9807: Wen Xu of SSLab at Georgia Tech
WebKit Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: A remote attacker may be able to cause arbitrary code execution Description: A logic issue was addressed with improved restrictions. CVE-2020-9850: @jinmo123, @setuid0x0_, and @insu_yun_en of @SSLab_Gatech working with Trend Micro’s Zero Day Initiative
WebKit Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: An input validation issue was addressed with improved input validation. CVE-2020-9843: Ryan Pickren (ryanpickren.com)
WebKit Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2020-9803: Wen Xu of SSLab at Georgia Tech
WebRTC Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: An access issue was addressed with improved memory management. CVE-2019-20503: Natalie Silvanovich of Google Project Zero
Additional recognition
WebKit We would like to acknowledge Aidan Dunlap of UT Austin for their assistance.
Installation note:
Safari 13.1.1 may be obtained from the Mac App Store. -----BEGIN PGP SIGNATURE----- Version: BCPG v1.64
iQIcBAEDCAAGBQJezV7rAAoJEAc+Lhnt8tDNAB4P/ii6fKM9mmFamwvDreABeVd7 u32JJjalk28WkDgudvnqa9cY/mzHtUwYODyrCaL3kjPisKiD7rRabVOWk8/rD6wi m6c8uk+g7of77qJ5m5y5g+TJdtYLxGItzJO5m9v+CqGrfX3hyCuIjnhsHrGWeqYF oYH4Xlkrw4Piy+Tw6jN5nBnR1I+d0C/h95SxOUIHae9HEjPmggF5QOfxMqzGNXWx MVO0jWoQL2Z4OzxMvmbNSQ5rkKeJNheedBdMuOMnh03o9wuyjgZV3aPEOMxVgE3g ZcCNIc1xjnGDiwhLab4/jqj7Py/EdpT04RADxymEgKpktLCIbSRi7skUkOvF7+zN IR8aVq5j4DXyJkadho4vjBhnkj0wCckyhsTw7kQ5ZGLqruFuB09ZwNHKhl9OcnXc TuamaVUn/ADC28NU2Fkf+/RaeYSvHSbvrDeDR0PDyCx5rLJwide/2UxNEZL4H8KD 2oIEr/I7BVeHcP8D0YYs3INtqJ3Yz0+P06bTvWh46bRw8uPkizcRS5IbpC+Sd5dh jd4efVe4ltTAQeDc91iSUnKy1vYpl/iOagHtO0CntnA/Fl44WEMR5NJDCQmQvA0i L8UWLAuJTZ1EngIlWv7ueqyhSp5qayX0PVQjAEpLxhgxmQXMmb9A83YMJYt7ORdk b2R6ImCxrVcNhr0o2lWK =MjL1 -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202006-1650",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "safari",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.1.1 \u672a\u6e80 (macos catalina)"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.1.1 \u672a\u6e80 (macos high sierra)"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.1.1 \u672a\u6e80 (macos mojave)"
},
{
"model": "safari",
"scope": null,
"trust": 0.7,
"vendor": "apple",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"db": "NVD",
"id": "CVE-2020-9801"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apple:safari",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "@jinmo123, @setuid0x0_, and @insu_yun_en of @SSLab_Gatech",
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-679"
}
],
"trust": 0.7
},
"cve": "CVE-2020-9801",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CVE-2020-9801",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.1,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 4.6,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-006256",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-187926",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.8,
"id": "CVE-2020-9801",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "Low",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2020-006256",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.8,
"id": "CVE-2020-9801",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-9801",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "JVNDB-2020-006256",
"trust": 0.8,
"value": "Medium"
},
{
"author": "ZDI",
"id": "CVE-2020-9801",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202005-1262",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-187926",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2020-9801",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"db": "VULHUB",
"id": "VHN-187926"
},
{
"db": "VULMON",
"id": "CVE-2020-9801"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-1262"
},
{
"db": "NVD",
"id": "CVE-2020-9801"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.1. A malicious process may cause Safari to launch an application. This vulnerability allows local attackers to escalate privileges on affected installations of Apple Safari. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of symbolic links. The issue results from the improper validation of symbolic links prior to performing operations on them. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the kernel. Apple Safari is a web browser of Apple (Apple), the default browser included with Mac OS X and iOS operating systems. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2020-05-26-7 Safari 13.1.1\n\nSafari 13.1.1 is now available and addresses the following:\n\nSafari\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: A malicious process may cause Safari to launch an application\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-9801: @jinmo123, @setuid0x0_, and @insu_yun_en of\n@SSLab_Gatech working with Trend Micro\u2019s Zero Day Initiative\n\nWebKit\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-9802: Samuel Gro\u00df of Google Project Zero\n\nWebKit\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: Processing maliciously crafted web content may lead to\nuniversal cross site scripting\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-9805: an anonymous researcher\n\nWebKit\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A type confusion issue was addressed with improved\nmemory handling. \nCVE-2020-9800: Brendan Draper (@6r3nd4n) working with Trend Micro\nZero Day Initiative\n\nWebKit\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed with improved\nstate management. \nCVE-2020-9806: Wen Xu of SSLab at Georgia Tech\nCVE-2020-9807: Wen Xu of SSLab at Georgia Tech\n\nWebKit\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-9850: @jinmo123, @setuid0x0_, and @insu_yun_en of\n@SSLab_Gatech working with Trend Micro\u2019s Zero Day Initiative\n\nWebKit\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: Processing maliciously crafted web content may lead to a\ncross site scripting attack\nDescription: An input validation issue was addressed with improved\ninput validation. \nCVE-2020-9843: Ryan Pickren (ryanpickren.com)\n\nWebKit\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2020-9803: Wen Xu of SSLab at Georgia Tech\n\nWebRTC\nAvailable for: macOS Mojave and macOS High Sierra, and included in\nmacOS Catalina\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: An access issue was addressed with improved memory\nmanagement. \nCVE-2019-20503: Natalie Silvanovich of Google Project Zero\n\nAdditional recognition\n\nWebKit\nWe would like to acknowledge Aidan Dunlap of UT Austin for their\nassistance. \n\nInstallation note:\n\nSafari 13.1.1 may be obtained from the Mac App Store. \n-----BEGIN PGP SIGNATURE-----\nVersion: BCPG v1.64\n\niQIcBAEDCAAGBQJezV7rAAoJEAc+Lhnt8tDNAB4P/ii6fKM9mmFamwvDreABeVd7\nu32JJjalk28WkDgudvnqa9cY/mzHtUwYODyrCaL3kjPisKiD7rRabVOWk8/rD6wi\nm6c8uk+g7of77qJ5m5y5g+TJdtYLxGItzJO5m9v+CqGrfX3hyCuIjnhsHrGWeqYF\noYH4Xlkrw4Piy+Tw6jN5nBnR1I+d0C/h95SxOUIHae9HEjPmggF5QOfxMqzGNXWx\nMVO0jWoQL2Z4OzxMvmbNSQ5rkKeJNheedBdMuOMnh03o9wuyjgZV3aPEOMxVgE3g\nZcCNIc1xjnGDiwhLab4/jqj7Py/EdpT04RADxymEgKpktLCIbSRi7skUkOvF7+zN\nIR8aVq5j4DXyJkadho4vjBhnkj0wCckyhsTw7kQ5ZGLqruFuB09ZwNHKhl9OcnXc\nTuamaVUn/ADC28NU2Fkf+/RaeYSvHSbvrDeDR0PDyCx5rLJwide/2UxNEZL4H8KD\n2oIEr/I7BVeHcP8D0YYs3INtqJ3Yz0+P06bTvWh46bRw8uPkizcRS5IbpC+Sd5dh\njd4efVe4ltTAQeDc91iSUnKy1vYpl/iOagHtO0CntnA/Fl44WEMR5NJDCQmQvA0i\nL8UWLAuJTZ1EngIlWv7ueqyhSp5qayX0PVQjAEpLxhgxmQXMmb9A83YMJYt7ORdk\nb2R6ImCxrVcNhr0o2lWK\n=MjL1\n-----END PGP SIGNATURE-----\n\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-9801"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"db": "VULHUB",
"id": "VHN-187926"
},
{
"db": "VULMON",
"id": "CVE-2020-9801"
},
{
"db": "PACKETSTORM",
"id": "157876"
}
],
"trust": 2.52
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-187926",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-187926"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-9801",
"trust": 3.4
},
{
"db": "ZDI",
"id": "ZDI-20-679",
"trust": 1.3
},
{
"db": "PACKETSTORM",
"id": "159447",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98042162",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006256",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-10774",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-202005-1262",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "157876",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.1867",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-187926",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2020-9801",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"db": "VULHUB",
"id": "VHN-187926"
},
{
"db": "VULMON",
"id": "CVE-2020-9801"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"db": "PACKETSTORM",
"id": "157876"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-1262"
},
{
"db": "NVD",
"id": "CVE-2020-9801"
}
]
},
"id": "VAR-202006-1650",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-187926"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T19:36:03.637000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT211177",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT211177"
},
{
"title": "HT211177",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT211177"
},
{
"title": "",
"trust": 0.7,
"url": "https://support.apple.com/en-gb/HT211177"
},
{
"title": "Apple Safari Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=119863"
},
{
"title": "The Register",
"trust": 0.1,
"url": "https://www.theregister.co.uk/2020/05/28/apple_may_updates/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"db": "VULMON",
"id": "CVE-2020-9801"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-1262"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-9801"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://support.apple.com/ht211177"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9801"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-9801"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu98042162/index.html"
},
{
"trust": 0.7,
"url": "https://support.apple.com/en-gb/ht211177"
},
{
"trust": 0.7,
"url": "https://packetstormsecurity.com/files/159447/safari-type-confusion-sandbox-escape.html"
},
{
"trust": 0.6,
"url": "https://www.zerodayinitiative.com/advisories/zdi-20-679/"
},
{
"trust": 0.6,
"url": "https://support.apple.com/kb/ht211177"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht211177"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1867/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/157876/apple-security-advisory-2020-05-26-7.html"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/modules/exploit/osx/browser/safari_in_operator_side_effect/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9800"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9807"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9806"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9843"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9805"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9803"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9802"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20503"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9850"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"db": "VULHUB",
"id": "VHN-187926"
},
{
"db": "VULMON",
"id": "CVE-2020-9801"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"db": "PACKETSTORM",
"id": "157876"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-1262"
},
{
"db": "NVD",
"id": "CVE-2020-9801"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"db": "VULHUB",
"id": "VHN-187926"
},
{
"db": "VULMON",
"id": "CVE-2020-9801"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"db": "PACKETSTORM",
"id": "157876"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-1262"
},
{
"db": "NVD",
"id": "CVE-2020-9801"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-05-28T00:00:00",
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"date": "2020-06-09T00:00:00",
"db": "VULHUB",
"id": "VHN-187926"
},
{
"date": "2020-06-09T00:00:00",
"db": "VULMON",
"id": "CVE-2020-9801"
},
{
"date": "2020-07-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"date": "2020-05-29T19:03:50",
"db": "PACKETSTORM",
"id": "157876"
},
{
"date": "2020-05-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202005-1262"
},
{
"date": "2020-06-09T17:15:12.097000",
"db": "NVD",
"id": "CVE-2020-9801"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-05-28T00:00:00",
"db": "ZDI",
"id": "ZDI-20-679"
},
{
"date": "2022-03-31T00:00:00",
"db": "VULHUB",
"id": "VHN-187926"
},
{
"date": "2022-03-31T00:00:00",
"db": "VULMON",
"id": "CVE-2020-9801"
},
{
"date": "2020-07-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-006256"
},
{
"date": "2021-10-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202005-1262"
},
{
"date": "2024-11-21T05:41:18.557000",
"db": "NVD",
"id": "CVE-2020-9801"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202005-1262"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Safari Logic vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006256"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202005-1262"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…