CVE-2020-9850

webkitgtk: Logic issue may lead to arbitrary code execution

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS 77.4% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 6 more

CVE-2020-9843

webkitgtk: Input validation issue may lead to cross site scripting

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to a cross site scripting attack.

CVSS 3.1 · 7.1 High EPSS 1.1% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 6 more

CVE-2020-9807

webkitgtk: Memory corruption may lead to arbitrary code execution

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 6 more

CVE-2020-9806

webkitgtk: Memory corruption may lead to arbitrary code execution

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 6 more

CVE-2020-9805

webkitgtk: Logic issue may lead to cross site scripting

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.

CVSS 3.1 · 7.1 High EPSS 1.2% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 6 more

CVE-2020-9803

webkitgtk: Memory corruption may lead to arbitrary code execution

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 6 more

CVE-2020-8625

A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

CVSS 3.1 · 8.1 High EPSS 65.4% KEV · Not listed

Vendors

Debian Fedoraproject Isc and 3 more

Products

Debian Linux Fedora Bind and 12 more

CVE-2020-36385

kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed

Vendors

Linux Netapp Redhat and 1 more

Products

Linux Kernel H300e H300e Firmware and 23 more

CVE-2020-29661

kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Broadcom Debian Fedoraproject and 4 more

Products

Fabric Operating System Debian Linux Fedora and 22 more

CVE-2020-29623

webkitgtk: User may be unable to fully delete browsing history

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing history.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apple Fedoraproject Redhat and 1 more

Products

Ipados Iphone Os Mac Os X and 6 more

CVE-2020-27918

webkitgtk: Use-after-free leading to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 2 more

Products

Icloud Ipados Iphone Os and 10 more

CVE-2020-13753

webkitgtk: Improper access management to CLONE_NEWUSER and the TIOCSTI ioctl

The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.

CVSS 3.1 · 10.0 Critical EPSS 3.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 4 more

CVE-2020-13584

webkitgtk: use-after-free may lead to arbitrary code execution

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed

Vendors

Fedoraproject Redhat Webkitgtk

Products

Fedora Enterprise Linux Rhel Els and 1 more

CVE-2020-13558

webkitgtk: Use-after-free in AudioSourceProviderGStreamer leading to arbitrary code execution

A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Redhat Webkitgtk

Products

Enterprise Linux Rhel Els Webkitgtk

CVE-2020-13543

webkitgtk: use-after-free may lead to arbitrary code execution

A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

CVSS 3.1 · 8.8 High EPSS 3.5% KEV · Not listed

Vendors

Redhat Webkitgtk

Products

Enterprise Linux Rhel Els Webkitgtk

CVE-2020-12362

kernel: Integer overflow in Intel(R) Graphics Drivers

Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Intel Linux Redhat

Products

Graphics Drivers Linux Kernel Enterprise Linux and 6 more

CVE-2020-0466

kernel: use after free in eventpoll.c may lead to escalation of privilege

In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Android Enterprise Linux Rhel Aus and 5 more

CVE-2019-5489

Kernel: page cache side channel attacks

The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Active Iq Performance Analytics Services Element Software Management Node and 8 more

CVE-2019-14287

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

CVSS 3.1 · 8.8 High EPSS 63.8% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 18 more

CVE-2018-8897

Kernel: error in exception handling leads to DoS

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.

CVSS 3.0 · 7.8 High EPSS 18.5% KEV · Not listed

Vendors

Apple Canonical Citrix and 5 more

Products

Mac Os X Ubuntu Linux Xenserver and 16 more