Severity Rating: High

Software Affected

·         Safari prior to 13.1.1

Overview

Multiple vulnerabilities have been reported in Safari and WebKit and WebRTC

components that could allow an attacker to execute arbitrary code, and to

perform universal cross site scripting attacks and memory corruption

attacks on the targeted system.

Description

Vulnerability in Safari (CVE-2020-9801)

This vulnerability exists in Safari due to which a malicious process may

cause Safari to launch an application. Successful exploitation of this

vulnerability could allow the attacker to execute privilege escalation

attacks. 

Multiple Vulnerabilities in WebKit (CVE-2020-9802, CVE-2020-9805,

CVE-2020-9800, CVE-2020-9806, CVE-2020-9807, CVE-2020-9850, CVE-2020-9843,

CVE-2020-9803)

These vulnerabilities exist in WebKit which may be exploited by sending

maliciously crafted web content. Successful exploitation of these

vulnerabilities may allow an attacker to execute arbitrary code and perform

cross site scripting attacks on the targeted system.

Vulnerability in WebRTC (CVE-2019-20503)

This vulnerability exists in WebRTC which may be exploited by sending

maliciously crafted web content. Successful exploitation of these could

lead to disclosure of process memory.

Solution

Apply appropriate updates mentioned in the Apple security updates

Vendor Information

Apple

https://support.apple.com/en-in/HT211177

Reference

Apple

https://support.apple.com/en-in/HT211177

Center for Internet Security

https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-produ

cts-could-allow-for-arbitrary-code-execution_2020-072/

CVE Name

CVE-2020-9801

CVE-2020-9802

CVE-2020-9805

CVE-2020-9800

CVE-2020-9806

CVE-2020-9807

CVE-2020-9850

CVE-2020-9843

CVE-2020-9803

CVE-2019-20503