# CVE-2020-27918: iTunes: A use after free issue was addressed with improved memory management.

CVE-2020-27918 is fixed in 65 products on 2 platforms, first by gir1.2-javascriptcoregtk-4.0 2.30.6-0ubuntu0.18.04.1, released July 8, 2021. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2020-27918
- Priority: High
- CVSS: 7.8 (Moderate)
- EPSS: 0.0143
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Dec 8, 2020
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2020-27918

## Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | iTunes | 12.11.4.15 | [iTunes 12.11.4.15](https://patchblox.com/security/data/fix/windows-app/apple.itunes-12.11.4.15.md) | Aug 4, 2021 |
| Linux | LibRaw RHEL 8 | 0:0.19.5-3.el8 | [RHSA-2021:4381](https://patchblox.com/security/data/fix/linux/rhsa-2021-4381.md) | Nov 9, 2021 |
| Linux | LibRaw ol 8 | 0:0.19.5-3.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | LibRaw-devel RHEL 8 | 0:0.19.5-3.el8 | [RHSA-2021:4381](https://patchblox.com/security/data/fix/linux/rhsa-2021-4381.md) | Nov 9, 2021 |
| Linux | LibRaw-devel ol 8 | 0:0.19.5-3.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | accountsservice ol 8 | 0:0.6.55-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | accountsservice-devel ol 8 | 0:0.6.55-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | accountsservice-libs ol 8 | 0:0.6.55-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gdm ol 8 | 1:40.0-15.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gir1.2-javascriptcoregtk-4.0 Ubuntu 18.04.6 LTS (bionic) | 2.30.6-0ubuntu0.18.04.1 | [gir1.2-javascriptcoregtk-4.0 2.30.6-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gir1.2-javascriptcoregtk-4.0-2.30.6-0ubuntu0.18.04.1.md) | Jul 8, 2021 |
| Linux | gir1.2-javascriptcoregtk-4.0 Ubuntu 20.04 LTS (focal) | 2.30.6-0ubuntu0.20.04.1 | [gir1.2-javascriptcoregtk-4.0 2.30.6-0ubuntu0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-gir1.2-javascriptcoregtk-4.0-2.30.6-0ubuntu0.20.04.1.md) | Jul 8, 2021 |
| Linux | gir1.2-webkit2-4.0 Ubuntu 18.04.6 LTS (bionic) | 2.30.6-0ubuntu0.18.04.1 | [gir1.2-webkit2-4.0 2.30.6-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gir1.2-webkit2-4.0-2.30.6-0ubuntu0.18.04.1.md) | Jul 8, 2021 |
| Linux | gir1.2-webkit2-4.0 Ubuntu 20.04 LTS (focal) | 2.30.6-0ubuntu0.20.04.1 | [gir1.2-webkit2-4.0 2.30.6-0ubuntu0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-gir1.2-webkit2-4.0-2.30.6-0ubuntu0.20.04.1.md) | Jul 8, 2021 |
| Linux | gnome-autoar RHEL 8 | 0:0.2.3-2.el8 | [RHSA-2021:4381](https://patchblox.com/security/data/fix/linux/rhsa-2021-4381.md) | Nov 9, 2021 |
| Linux | gnome-autoar ol 8 | 0:0.2.3-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-calculator ol 8 | 0:3.28.2-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-classic-session ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-control-center ol 8 | 0:3.28.2-28.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-control-center-filesystem ol 8 | 0:3.28.2-28.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-online-accounts ol 8 | 0:3.28.2-3.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-online-accounts-devel ol 8 | 0:3.28.2-3.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-session ol 8 | 0:3.28.1-13.0.1.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-session-kiosk-session ol 8 | 0:3.28.1-13.0.1.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-session-wayland-session ol 8 | 0:3.28.1-13.0.1.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-session-xsession ol 8 | 0:3.28.1-13.0.1.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-settings-daemon ol 8 | 0:3.32.0-16.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell ol 8 | 0:3.32.2-40.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-apps-menu ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-auto-move-windows ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-common ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-dash-to-dock ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-desktop-icons ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-disable-screenshield ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-drive-menu ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-gesture-inhibitor ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-horizontal-workspaces ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-launch-new-instance ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-native-window-placement ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-no-hot-corner ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-panel-favorites ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-places-menu ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-screenshot-window-sizer ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-systemMonitor ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-top-icons ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-updates-dialog ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-user-theme ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-window-grouper ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-window-list ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-windowsNavigator ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-shell-extension-workspace-indicator ol 8 | 0:3.32.1-20.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-software ol 8 | 0:3.36.1-10.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gnome-software-devel ol 8 | 0:3.36.1-10.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gsettings-desktop-schemas ol 8 | 0:3.32.0-6.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gsettings-desktop-schemas-devel ol 8 | 0:3.32.0-6.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gtk-update-icon-cache ol 8 | 0:3.22.30-8.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gtk3 ol 8 | 0:3.22.30-8.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gtk3-devel ol 8 | 0:3.22.30-8.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | gtk3-immodule-xim ol 8 | 0:3.22.30-8.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | libjavascriptcoregtk-4.0-18 Ubuntu 18.04.6 LTS (bionic) | 2.30.6-0ubuntu0.18.04.1 | [libjavascriptcoregtk-4.0-18 2.30.6-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjavascriptcoregtk-4.0-18-2.30.6-0ubuntu0.18.04.1.md) | Jul 8, 2021 |
| Linux | libjavascriptcoregtk-4.0-18 Ubuntu 20.04 LTS (focal) | 2.30.6-0ubuntu0.20.04.1 | [libjavascriptcoregtk-4.0-18 2.30.6-0ubuntu0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libjavascriptcoregtk-4.0-18-2.30.6-0ubuntu0.20.04.1.md) | Jul 8, 2021 |
| Linux | libjavascriptcoregtk-4.0-bin Ubuntu 18.04.6 LTS (bionic) | 2.30.6-0ubuntu0.18.04.1 | [libjavascriptcoregtk-4.0-bin 2.30.6-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjavascriptcoregtk-4.0-bin-2.30.6-0ubuntu0.18.04.1.md) | Jul 8, 2021 |
| Linux | libjavascriptcoregtk-4.0-bin Ubuntu 20.04 LTS (focal) | 2.30.6-0ubuntu0.20.04.1 | [libjavascriptcoregtk-4.0-bin 2.30.6-0ubuntu0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libjavascriptcoregtk-4.0-bin-2.30.6-0ubuntu0.20.04.1.md) | Jul 8, 2021 |
| Linux | libwebkit2gtk-4.0-37 Ubuntu 18.04.6 LTS (bionic) | 2.30.6-0ubuntu0.18.04.1 | [libwebkit2gtk-4.0-37 2.30.6-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libwebkit2gtk-4.0-37-2.30.6-0ubuntu0.18.04.1.md) | Jul 8, 2021 |
| Linux | libwebkit2gtk-4.0-37 Ubuntu 20.04 LTS (focal) | 2.30.6-0ubuntu0.20.04.1 | [libwebkit2gtk-4.0-37 2.30.6-0ubuntu0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libwebkit2gtk-4.0-37-2.30.6-0ubuntu0.20.04.1.md) | Jul 8, 2021 |
| Linux | libwebkit2gtk-4.0-37-gtk2 Ubuntu 18.04.6 LTS (bionic) | 2.30.6-0ubuntu0.18.04.1 | [libwebkit2gtk-4.0-37-gtk2 2.30.6-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libwebkit2gtk-4.0-37-gtk2-2.30.6-0ubuntu0.18.04.1.md) | Jul 8, 2021 |
| Linux | libwebkit2gtk-4.0-37-gtk2 Ubuntu 20.04 LTS (focal) | 2.30.6-0ubuntu0.20.04.1 | [libwebkit2gtk-4.0-37-gtk2 2.30.6-0ubuntu0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libwebkit2gtk-4.0-37-gtk2-2.30.6-0ubuntu0.20.04.1.md) | Jul 8, 2021 |
| Linux | mutter ol 8 | 0:3.32.2-60.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | mutter-devel ol 8 | 0:3.32.2-60.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | vino ol 8 | 0:3.22.0-11.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | webkit2gtk-driver Ubuntu 18.04.6 LTS (bionic) | 2.30.6-0ubuntu0.18.04.1 | [webkit2gtk-driver 2.30.6-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-webkit2gtk-driver-2.30.6-0ubuntu0.18.04.1.md) | Jul 8, 2021 |
| Linux | webkit2gtk-driver Ubuntu 20.04 LTS (focal) | 2.30.6-0ubuntu0.20.04.1 | [webkit2gtk-driver 2.30.6-0ubuntu0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-webkit2gtk-driver-2.30.6-0ubuntu0.20.04.1.md) | Jul 8, 2021 |
| Linux | webkit2gtk3 RHEL 8 | 0:2.32.3-2.el8 | [RHSA-2021:4381](https://patchblox.com/security/data/fix/linux/rhsa-2021-4381.md) | Nov 9, 2021 |
| Linux | webkit2gtk3 ol 8 | 0:2.32.3-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | webkit2gtk3-devel RHEL 8 | 0:2.32.3-2.el8 | [RHSA-2021:4381](https://patchblox.com/security/data/fix/linux/rhsa-2021-4381.md) | Nov 9, 2021 |
| Linux | webkit2gtk3-devel ol 8 | 0:2.32.3-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | webkit2gtk3-jsc RHEL 8 | 0:2.32.3-2.el8 | [RHSA-2021:4381](https://patchblox.com/security/data/fix/linux/rhsa-2021-4381.md) | Nov 9, 2021 |
| Linux | webkit2gtk3-jsc ol 8 | 0:2.32.3-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |
| Linux | webkit2gtk3-jsc-devel RHEL 8 | 0:2.32.3-2.el8 | [RHSA-2021:4381](https://patchblox.com/security/data/fix/linux/rhsa-2021-4381.md) | Nov 9, 2021 |
| Linux | webkit2gtk3-jsc-devel ol 8 | 0:2.32.3-2.el8 | [ELSA-2021-4381](https://patchblox.com/security/data/fix/linux/elsa-2021-4381.md) | Nov 16, 2021 |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.