Vulnerability · Published Oct 16, 2020 · Assigned by apple
CVE-2020-9948
High 8.8
In plain English
A high-severity security flaw in Safari from Apple. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.7%top 22.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | OpenEXR-devel | 2.2.0-12.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | OpenEXR-libs | 2.2.0-12.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | accountsservice-devel | 0.6.55-1.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | atkmm | 2.24.2-7.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | atkmm-devel | 2.24.2-7.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | atkmm-doc | 2.24.2-7.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | cairomm | 1.12.0-8.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | cairomm-devel | 1.12.0-8.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | cairomm-doc | 1.12.0-8.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | chrome-gnome-shell | 10.1-7.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | dleyna-core | 0.6.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | dleyna-server | 0.6.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | enchant2 | 2.2.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | enchant2-devel | 2.2.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gamin | 0.1.10-32.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gamin-devel | 0.1.10-32.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geoclue2 | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geoclue2-demos | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geoclue2-devel | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geoclue2-libs | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geocode-glib | 3.26.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | geocode-glib-devel | 3.26.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gjs | 1.56.2-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gjs-devel | 1.56.2-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glib2-doc | 2.56.4-9.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glib2-static | 2.56.4-9.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glibmm24 | 2.56.0-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glibmm24-devel | 2.56.0-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | glibmm24-doc | 2.56.0-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-boxes | 3.36.5-8.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-photos | 3.28.1-4.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-photos-tests | 3.28.1-4.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-terminal | 3.28.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gnome-terminal-nautilus | 3.28.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk-doc | 1.28-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2 | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2-devel | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2-devel-docs | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2-immodule-xim | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtk2-immodules | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm24 | 2.24.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm24-devel | 2.24.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm24-docs | 2.24.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm30 | 3.22.2-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm30-devel | 3.22.2-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gtkmm30-doc | 3.22.2-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-afc | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-afp | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-archive | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-client | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-devel | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-fuse | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-goa | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-gphoto2 | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-mtp | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | gvfs-smb | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libdazzle | 3.28.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libdazzle-devel | 3.28.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libepubgen | 0.1.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libepubgen-devel | 0.1.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsass | 3.4.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsass-devel | 3.4.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsigc++20 | 2.10.0-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsigc++20-devel | 2.10.0-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libsigc++20-doc | 2.10.0-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libvisual | 1:0.4.0-25.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | libvisual-devel | 1:0.4.0-25.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | mutter-devel | 3.32.2-57.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | nautilus | 3.28.1-15.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | nautilus-devel | 3.28.1-15.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | nautilus-extensions | 3.28.1-15.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | pangomm | 2.40.1-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | pangomm-devel | 2.40.1-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | pangomm-doc | 2.40.1-6.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | soundtouch | 2.0.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | soundtouch-devel | 2.0.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | vala | 0.40.19-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | vala-devel | 0.40.19-2.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | woff2 | 1.0.2-5.el8 | ALSA-2021:1586 |
| AlmaLinux:8 | woff2-devel | 1.0.2-5.el8 | ALSA-2021:1586 |
| Alpine:v3.20 | webkit2gtk | 2.30.0-r0 | ALPINE-CVE-2020-9948 |
| Debian:12 | webkit2gtk | 2.30.1-1 | DEBIAN-CVE-2020-9948 |
| Debian:13 | webkit2gtk | 2.30.1-1 | DEBIAN-CVE-2020-9948 |
| Debian:14 | webkit2gtk | 2.30.1-1 | DEBIAN-CVE-2020-9948 |
| Debian:12 | wpewebkit | 2.30.0-1 | DEBIAN-CVE-2020-9948 |
| Debian:13 | wpewebkit | 2.30.0-1 | DEBIAN-CVE-2020-9948 |
| Debian:14 | wpewebkit | 2.30.0-1 | DEBIAN-CVE-2020-9948 |
| Rocky Linux:8 | OpenEXR | 0:2.2.0-12.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | accountsservice | 0:0.6.55-1.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | atkmm | 0:2.24.2-7.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | cairomm | 0:1.12.0-8.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | chrome-gnome-shell | 0:10.1-7.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | dleyna-core | 0:0.6.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | dleyna-server | 0:0.6.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | enchant2 | 0:2.2.3-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gamin | 0:0.1.10-32.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gdm | 1:3.28.3-39.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | geoclue2 | 0:2.5.5-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | geocode-glib | 0:3.26.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gjs | 0:1.56.2-5.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | glibmm24 | 0:2.56.0-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-boxes | 0:3.36.5-8.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-boxes | 0:3.36.5-8.el8.rocky.0.1 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-control-center | 0:3.28.2-27.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-online-accounts | 0:3.28.2-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-photos | 0:3.28.1-4.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-settings-daemon | 0:3.32.0-14.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-shell | 0:3.32.2-30.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-software | 0:3.36.1-5.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gnome-terminal | 0:3.28.3-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gtk-doc | 0:1.28-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gtk2 | 0:2.24.32-5.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gtkmm24 | 0:2.24.5-6.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gtkmm30 | 0:3.22.2-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | gvfs | 0:1.36.2-11.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libdazzle | 0:3.28.5-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libepubgen | 0:0.1.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libsass | 0:3.4.5-6.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libsigc++20 | 0:2.10.0-6.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | libvisual | 1:0.4.0-25.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | mutter | 0:3.32.2-57.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | nautilus | 0:3.28.1-15.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | pangomm | 0:2.40.1-6.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | soundtouch | 0:2.0.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | vala | 0:0.40.19-2.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | webkit2gtk3 | 0:2.30.4-1.el8 | RLSA-2021:1586 |
| Rocky Linux:8 | woff2 | 0:1.0.2-5.el8 | RLSA-2021:1586 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2020-9948 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2020-9948 |
Affected products (as reported)
References
- https://support.apple.com/HT211845 x_refsource_MISC
- 20201115 APPLE-SA-2020-11-13-5 Additional information for APPLE-SA-2020-09-16-3 Safari 14.0 mailing-list, x_refsource_FULLDISC
- [oss-security] 20201123 WebKitGTK and WPE WebKit Security Advisory WSA-2020-0008 mailing-list, x_refsource_MLIST
- DSA-4797 vendor-advisory, x_refsource_DEBIAN
- GLSA-202012-10 vendor-advisory, x_refsource_GENTOO