CVE-2020-9856 : This issue was addressed with improved checks. This issue is fixed in macOS Cata

This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.5. An application may be able to gain elevated privileges.

Published 2020-06-09 17:15:15

Updated 2022-03-31 01:40:28

Source Apple Inc.

View at NVD, CVE.org

Products affected by CVE-2020-9856

Apple » Mac Os X
Versions from including (>=) 10.15 and before (<) 10.15.5
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X
Versions from including (>=) 10.13 and before (<) 10.13.6
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X
Versions from including (>=) 10.14 and before (<) 10.14.6
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6
cpe:2.3:o:apple:mac_os_x:10.13.6:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6
cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-001
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-002
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-006
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-007
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2020-001
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2020-002
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2020-003
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-004
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-005
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6
cpe:2.3:o:apple:mac_os_x:10.14.6:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6
cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2018-002
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2018-003
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-001
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-002
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-003
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-004
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-005
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-006
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-007
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2020-001
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2020-002
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-9856

EPSS FAQ

13.79%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-9856

Safari in Operator Side Effect Exploit

Disclosure Date: 2020-03-18

First seen: 2020-10-01

exploit/osx/browser/safari_in_operator_side_effect

This module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the <embed> element with the PDF plugin provides a callback that can trigger side-effects leading to type

More information

CVSS scores for CVE-2020-9856

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
5.3	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	1.8	3.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low

References for CVE-2020-9856

https://support.apple.com/HT211170

About the security content of macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra - Apple Support
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-9856

Products affected by CVE-2020-9856

Exploit prediction scoring system (EPSS) score for CVE-2020-9856

Metasploit modules for CVE-2020-9856

Safari in Operator Side Effect Exploit

CVSS scores for CVE-2020-9856

References for CVE-2020-9856