CVE-2020-9932

HIGH

Safari < 13.0.1 - Remote Code Execution via Malicious Web Content

Title source: llm
STIX 2.1

Description

A memory corruption issue was addressed with improved validation. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, tvOS 13. Processing maliciously crafted web content may lead to arbitrary code execution.

References (3)

Core 3
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210604
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210603
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210605

Scores

CVSS v3 8.8
EPSS 0.0112
EPSS Percentile 62.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (4)
apple/ipados < 13.1
apple/iphone_os < 13.1
apple/safari < 13.0.1
apple/tvos < 13.0
Published Oct 27, 2020
Tracked Since Feb 18, 2026