Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2021-03027

Опубликовано: 20 мая 2020
Источник: fstec
CVSS3: 9.8
CVSS2: 10
EPSS Высокий

Описание

Уязвимость модуля отображения веб-страниц WebKit операционных систем Mac OS связана с неправильной реализацией последовательности выполняемых действий. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код с помощью вредоносного веб-контента

Вендор

Novell Inc.
Red Hat Inc.
Apple Inc.
Сообщество свободного программного обеспечения

Наименование ПО

SUSE Linux Enterprise Server for SAP Applications
Red Hat Enterprise Linux
SUSE Linux Enterprise Point of Sale
Suse Linux Enterprise Server
OpenSUSE Leap
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
iTunes for Windows
iCloud for Windows
iOS
iPadOS
tvOS
watchOS
Safari
WebKitGTK
WPE WebKit

Версия ПО

12 SP2 (SUSE Linux Enterprise Server for SAP Applications)
12 SP2-BCL (SUSE Linux Enterprise Server for SAP Applications)
12 SP2-ESPOS (SUSE Linux Enterprise Server for SAP Applications)
12 SP2-LTSS (SUSE Linux Enterprise Server for SAP Applications)
12 SP3 (SUSE Linux Enterprise Server for SAP Applications)
12 SP4 (SUSE Linux Enterprise Server for SAP Applications)
8 (Red Hat Enterprise Linux)
12 SP2-CLIENT (SUSE Linux Enterprise Point of Sale)
12 SP2-BCL (Suse Linux Enterprise Server)
12 SP2-ESPOS (Suse Linux Enterprise Server)
15.1 (OpenSUSE Leap)
15 (SUSE Linux Enterprise Server for SAP Applications)
12 SP2-LTSS (Suse Linux Enterprise Server)
12 SP3-LTSS (Suse Linux Enterprise Server)
12 SP3-BCL (Suse Linux Enterprise Server)
12 SP5 (Suse Linux Enterprise Server)
12 SP3-BCL (SUSE Linux Enterprise Server for SAP Applications)
12 SP3-LTSS (SUSE Linux Enterprise Server for SAP Applications)
12 SP5 (SUSE Linux Enterprise Server for SAP Applications)
12 SP5 (SUSE Linux Enterprise Software Development Kit)
12 SP3-ESPOS (Suse Linux Enterprise Server)
12 SP3-ESPOS (SUSE Linux Enterprise Server for SAP Applications)
15-ESPOS (SUSE Linux Enterprise High Performance Computing)
15-LTSS (SUSE Linux Enterprise High Performance Computing)
15-LTSS (Suse Linux Enterprise Server)
12 SP4-ESPOS (Suse Linux Enterprise Server)
12 SP4-LTSS (SUSE Linux Enterprise Server for SAP Applications)
12 SP4-ESPOS (SUSE Linux Enterprise Server for SAP Applications)
до 12.10.7 (iTunes for Windows)
до 7.19 (iCloud for Windows)
от 11.0 до 11.2 (iCloud for Windows)
до 13.5 (iOS)
до 13.5 (iPadOS)
до 13.4.5 (tvOS)
до 6.2.5 (watchOS)
до 13.1.1 (Safari)
12 SP4-LTSS (Suse Linux Enterprise Server)
до 2.28.3 (WebKitGTK)
до 2.28.3 (WPE WebKit)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2-BCL
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2-ESPOS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2-LTSS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP3
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4
Red Hat Inc. Red Hat Enterprise Linux 8
Novell Inc. Suse Linux Enterprise Server 12 SP2-BCL
Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS
Novell Inc. OpenSUSE Leap 15.1
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15
Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP3-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP3-BCL
Novell Inc. Suse Linux Enterprise Server 12 SP5
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP3-BCL
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP3-LTSS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5
Novell Inc. Suse Linux Enterprise Server 12 SP3-ESPOS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP3-ESPOS
Novell Inc. Suse Linux Enterprise Server 15-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP4-ESPOS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4-LTSS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4-ESPOS
Apple Inc. iOS до 13.5
Apple Inc. iPadOS до 13.5
Apple Inc. tvOS до 13.4.5
Apple Inc. watchOS до 6.2.5
Novell Inc. Suse Linux Enterprise Server 12 SP4-LTSS

Уровень опасности уязвимости

Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)
Критический уровень опасности (базовая оценка CVSS 3.0 составляет 9,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для программных продуктов Apple Inc.:
https://support.apple.com/HT211168
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211177
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2020-9850
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2020-9850/
Для WebKit:
https://webkitgtk.org/security/WSA-2020-0006.html

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 99%
0.83602
Высокий

9.8 Critical

CVSS3

10 Critical

CVSS2

Связанные уязвимости

CVSS3: 9.8
ubuntu
около 5 лет назад

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.

CVSS3: 7.3
redhat
около 5 лет назад

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.

CVSS3: 9.8
nvd
около 5 лет назад

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.

CVSS3: 9.8
debian
около 5 лет назад

A logic issue was addressed with improved restrictions. This issue is ...

CVSS3: 9.8
github
около 3 лет назад

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.

EPSS

Процентиль: 99%
0.83602
Высокий

9.8 Critical

CVSS3

10 Critical

CVSS2