CVE-2020-9951: 
Apple iCloud vulnerability analysis and mitigation

CVE-2020-9951 is a use-after-free vulnerability that was discovered in WebKit, affecting Safari and other WebKit-based browsers. The vulnerability was fixed in Safari 14.0, released on September 16, 2020. The issue affected multiple Apple products including Safari, iOS, iPadOS, tvOS, and watchOS, as well as WebKitGTK and WPE WebKit (Apple HT211845, WebKit Advisory).

The vulnerability is a use-after-free issue in WebKit that was addressed with improved memory management. It has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability was discovered by Marcin 'Icewall' Noga of Cisco Talos (NVD).

When exploited, this vulnerability could allow an attacker to execute arbitrary code by processing maliciously crafted web content. This could potentially lead to complete system compromise if the user has elevated privileges (Debian Advisory, WebKit Advisory).

The vulnerability requires user interaction, specifically processing maliciously crafted web content. The attack can be performed remotely and does not require privileges, making it relatively accessible to potential attackers (NVD).

The vulnerability was patched in Safari 14.0 and corresponding versions of other affected products. Users should update to Safari 14.0 or later, iOS/iPadOS 14.0 or later, tvOS 14.0 or later, and watchOS 7.0 or later. For WebKitGTK and WPE WebKit users, updating to version 2.30.3 or later is recommended (Apple HT211845, Gentoo Advisory).