CVE-2020-9894

Se abordó una lectura fuera de límites con una comprobación de entrada mejorada. Este problema es corregido en iOS versión 13.6 y iPadOS versión 13.6, tvOS versión 13.4.8, watchOS versión 6.2.8, Safari versión 13.1.2, iTunes versión 12.10.8 para Windows, iCloud para Windows versión 11.3, iCloud para Windows versión 7.20. Un atacante remoto puede causar la terminación inesperada de la aplicación o una ejecución de código arbitraria

An out-of-bounds read flaw was found in webkitgtk that affected WebKitGTK versions before 2.28.4 and WPE WebKit versions before 2.28.4. This flaw allows a remote attacker to cause unexpected application termination or arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

This vulnerability allows remote attackers to disclose sensitive information code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the getAnimations method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.