Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2020-AVI-063
Vulnerability from certfr_avis - Published: 2020-01-29 - Updated: 2020-01-30
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | macOS | macOS Catalina versions antérieures à 10.15.3 | ||
| Apple | macOS | macOS Mojave sans le correctif de sécurité 2020-001 | ||
| Apple | N/A | iCloud pour Windows versions 10.x antérieures à 10.9.2 | ||
| Apple | N/A | iOS versions antérieures à 13.3.1 | ||
| Apple | N/A | watchOS versions antérieures à6.1.2 | ||
| Apple | N/A | iCloud pour Windows versions antérieures à 7.17 | ||
| Apple | Safari | Safari versions antérieures à 13.0.5 | ||
| Apple | N/A | iPadOS versions antérieures à 13.3.1 | ||
| Apple | N/A | tvOS versions antérieures à13.3.1 | ||
| Apple | macOS | macOS High Sierra sans le correctif de sécurité 2020-001 | ||
| Apple | N/A | iTunes versions antérieures à 12.10.4 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "macOS Catalina versions ant\u00e9rieures \u00e0 10.15.3",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Mojave sans le correctif de s\u00e9curit\u00e9 2020-001",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iCloud pour Windows versions 10.x ant\u00e9rieures \u00e0 10.9.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 13.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e06.1.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iCloud pour Windows versions ant\u00e9rieures \u00e0 7.17",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 13.0.5",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 13.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e013.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS High Sierra sans le correctif de s\u00e9curit\u00e9 2020-001",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iTunes versions ant\u00e9rieures \u00e0 12.10.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-3859",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3859"
},
{
"name": "CVE-2020-3878",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3878"
},
{
"name": "CVE-2020-3860",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3860"
},
{
"name": "CVE-2020-3838",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3838"
},
{
"name": "CVE-2020-3873",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3873"
},
{
"name": "CVE-2020-3855",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3855"
},
{
"name": "CVE-2019-18634",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18634"
},
{
"name": "CVE-2020-3869",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3869"
},
{
"name": "CVE-2020-3843",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3843"
},
{
"name": "CVE-2020-3862",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3862"
},
{
"name": "CVE-2020-3865",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3865"
},
{
"name": "CVE-2020-3853",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3853"
},
{
"name": "CVE-2020-3857",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3857"
},
{
"name": "CVE-2020-3858",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3858"
},
{
"name": "CVE-2020-3849",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3849"
},
{
"name": "CVE-2020-3845",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3845"
},
{
"name": "CVE-2020-3870",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3870"
},
{
"name": "CVE-2020-3837",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3837"
},
{
"name": "CVE-2020-3834",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3834"
},
{
"name": "CVE-2020-3831",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3831"
},
{
"name": "CVE-2020-3830",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3830"
},
{
"name": "CVE-2020-3835",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3835"
},
{
"name": "CVE-2020-3848",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3848"
},
{
"name": "CVE-2020-3841",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3841"
},
{
"name": "CVE-2020-3872",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3872"
},
{
"name": "CVE-2020-3826",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3826"
},
{
"name": "CVE-2020-3867",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3867"
},
{
"name": "CVE-2020-3828",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3828"
},
{
"name": "CVE-2020-3850",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3850"
},
{
"name": "CVE-2020-3839",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3839"
},
{
"name": "CVE-2020-3842",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3842"
},
{
"name": "CVE-2020-3827",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3827"
},
{
"name": "CVE-2020-3874",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3874"
},
{
"name": "CVE-2020-3854",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3854"
},
{
"name": "CVE-2020-3871",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3871"
},
{
"name": "CVE-2019-11043",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11043"
},
{
"name": "CVE-2020-3833",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3833"
},
{
"name": "CVE-2020-3844",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3844"
},
{
"name": "CVE-2020-3877",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3877"
},
{
"name": "CVE-2020-3868",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3868"
},
{
"name": "CVE-2020-3856",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3856"
},
{
"name": "CVE-2020-3846",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3846"
},
{
"name": "CVE-2020-3861",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3861"
},
{
"name": "CVE-2020-3825",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3825"
},
{
"name": "CVE-2020-3840",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3840"
},
{
"name": "CVE-2020-3829",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3829"
},
{
"name": "CVE-2020-3836",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3836"
},
{
"name": "CVE-2020-3875",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3875"
},
{
"name": "CVE-2020-3847",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3847"
},
{
"name": "CVE-2020-3866",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3866"
}
],
"initial_release_date": "2020-01-29T00:00:00",
"last_revision_date": "2020-01-30T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-063",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-01-29T00:00:00.000000"
},
{
"description": "Ajout des avis HT210947 et HT210948 du 28 janvier 2020",
"revision_date": "2020-01-30T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT210918 du 28 janvier 2020",
"url": "https://support.apple.com/en-us/HT210918"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT210948 du 28 janvier 2020",
"url": "https://support.apple.com/en-us/HT210948"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT210923 du 28 janvier 2020",
"url": "https://support.apple.com/en-us/HT210923"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT210922 du 28 janvier 2020",
"url": "https://support.apple.com/en-us/HT210922"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT210921 du 28 janvier 2020",
"url": "https://support.apple.com/en-us/HT210921"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT210947 du 28 janvier 2020",
"url": "https://support.apple.com/en-us/HT210947"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT210920 du 28 janvier 2020",
"url": "https://support.apple.com/en-us/HT210920"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT210919 du 28 janvier 2020",
"url": "https://support.apple.com/en-us/HT210919"
}
]
}
CVE-2020-3834 (GCVE-0-2020-3834)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
Severity
No CVSS data available.
CWE
- An application may be able to execute arbitrary code with kernel privileges
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.apple.com/HT210921 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:50.984Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210921"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "watchOS 6.1.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An application may be able to execute arbitrary code with kernel privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T20:45:04.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210921"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3834",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "watchOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "watchOS 6.1.2"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "An application may be able to execute arbitrary code with kernel privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210921",
"refsource": "MISC",
"url": "https://support.apple.com/HT210921"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3834",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:50.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3835 (GCVE-0-2020-3835)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.3. A malicious application may be able to access restricted files.
Severity
No CVSS data available.
CWE
- A malicious application may be able to access restricted files
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.apple.com/HT210919 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.249Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210919"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "macOS Catalina 10.15.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.3. A malicious application may be able to access restricted files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A malicious application may be able to access restricted files",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T20:45:04.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210919"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3835",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "macOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "macOS Catalina 10.15.3"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.3. A malicious application may be able to access restricted files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "A malicious application may be able to access restricted files"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210919",
"refsource": "MISC",
"url": "https://support.apple.com/HT210919"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3835",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:51.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3836 (GCVE-0-2020-3836)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
An access issue was addressed with improved memory management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to determine kernel memory layout.
Severity
No CVSS data available.
CWE
- A malicious application may be able to determine kernel memory layout
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://support.apple.com/HT210919 | x_refsource_MISC |
| https://support.apple.com/HT210918 | x_refsource_MISC |
| https://support.apple.com/HT210921 | x_refsource_MISC |
| https://support.apple.com/HT210920 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.287Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210921"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210920"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "iOS 13.3.1 and iPadOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "macOS Catalina 10.15.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "tvOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "watchOS 6.1.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An access issue was addressed with improved memory management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to determine kernel memory layout."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A malicious application may be able to determine kernel memory layout",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T20:45:04.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210921"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210920"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3836",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "iOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "iOS 13.3.1 and iPadOS 13.3.1"
}
]
}
},
{
"product_name": "macOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "macOS Catalina 10.15.3"
}
]
}
},
{
"product_name": "tvOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "tvOS 13.3.1"
}
]
}
},
{
"product_name": "watchOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "watchOS 6.1.2"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An access issue was addressed with improved memory management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to determine kernel memory layout."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "A malicious application may be able to determine kernel memory layout"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210919",
"refsource": "MISC",
"url": "https://support.apple.com/HT210919"
},
{
"name": "https://support.apple.com/HT210918",
"refsource": "MISC",
"url": "https://support.apple.com/HT210918"
},
{
"name": "https://support.apple.com/HT210921",
"refsource": "MISC",
"url": "https://support.apple.com/HT210921"
},
{
"name": "https://support.apple.com/HT210920",
"refsource": "MISC",
"url": "https://support.apple.com/HT210920"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3836",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:51.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3837 (GCVE-0-2020-3837)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2025-10-21 23:35
VLAI
EPSS
Summary
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
Severity
7.8 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- An application may be able to execute arbitrary code with kernel privileges
- CWE-787 - Out-of-bounds Write
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://support.apple.com/HT210919 | x_refsource_MISC |
| https://support.apple.com/HT210918 | x_refsource_MISC |
| https://support.apple.com/HT210921 | x_refsource_MISC |
| https://support.apple.com/HT210920 | x_refsource_MISC |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210921"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210920"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2020-3837",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T17:40:16.816484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2022-06-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3837"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:35:50.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3837"
}
],
"timeline": [
{
"lang": "en",
"time": "2022-06-27T00:00:00.000Z",
"value": "CVE-2020-3837 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "iOS 13.3.1 and iPadOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "macOS Catalina 10.15.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "tvOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "watchOS 6.1.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An application may be able to execute arbitrary code with kernel privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T20:45:04.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210921"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210920"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3837",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "iOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "iOS 13.3.1 and iPadOS 13.3.1"
}
]
}
},
{
"product_name": "macOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "macOS Catalina 10.15.3"
}
]
}
},
{
"product_name": "tvOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "tvOS 13.3.1"
}
]
}
},
{
"product_name": "watchOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "watchOS 6.1.2"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "An application may be able to execute arbitrary code with kernel privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210919",
"refsource": "MISC",
"url": "https://support.apple.com/HT210919"
},
{
"name": "https://support.apple.com/HT210918",
"refsource": "MISC",
"url": "https://support.apple.com/HT210918"
},
{
"name": "https://support.apple.com/HT210921",
"refsource": "MISC",
"url": "https://support.apple.com/HT210921"
},
{
"name": "https://support.apple.com/HT210920",
"refsource": "MISC",
"url": "https://support.apple.com/HT210920"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3837",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:35:50.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3838 (GCVE-0-2020-3838)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with system privileges.
Severity
No CVSS data available.
CWE
- An application may be able to execute arbitrary code with system privileges
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://support.apple.com/HT210919 | x_refsource_MISC |
| https://support.apple.com/HT210918 | x_refsource_MISC |
| https://support.apple.com/HT210921 | x_refsource_MISC |
| https://support.apple.com/HT210920 | x_refsource_MISC |
| https://support.apple.com/kb/HT212326 | x_refsource_CONFIRM |
| https://support.apple.com/kb/HT212327 | x_refsource_CONFIRM |
| http://seclists.org/fulldisclosure/2021/Apr/51 | mailing-listx_refsource_FULLDISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.242Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210921"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210920"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/kb/HT212326"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/kb/HT212327"
},
{
"name": "20210427 APPLE-SA-2021-04-26-3 Security Update 2021-002 Catalina",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Apr/51"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "iOS 13.3.1 and iPadOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "macOS Catalina 10.15.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "tvOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "watchOS 6.1.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with system privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An application may be able to execute arbitrary code with system privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-27T20:06:45.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210921"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210920"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/kb/HT212326"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/kb/HT212327"
},
{
"name": "20210427 APPLE-SA-2021-04-26-3 Security Update 2021-002 Catalina",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Apr/51"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3838",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "iOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "iOS 13.3.1 and iPadOS 13.3.1"
}
]
}
},
{
"product_name": "macOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "macOS Catalina 10.15.3"
}
]
}
},
{
"product_name": "tvOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "tvOS 13.3.1"
}
]
}
},
{
"product_name": "watchOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "watchOS 6.1.2"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with system privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "An application may be able to execute arbitrary code with system privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210919",
"refsource": "MISC",
"url": "https://support.apple.com/HT210919"
},
{
"name": "https://support.apple.com/HT210918",
"refsource": "MISC",
"url": "https://support.apple.com/HT210918"
},
{
"name": "https://support.apple.com/HT210921",
"refsource": "MISC",
"url": "https://support.apple.com/HT210921"
},
{
"name": "https://support.apple.com/HT210920",
"refsource": "MISC",
"url": "https://support.apple.com/HT210920"
},
{
"name": "https://support.apple.com/kb/HT212326",
"refsource": "CONFIRM",
"url": "https://support.apple.com/kb/HT212326"
},
{
"name": "https://support.apple.com/kb/HT212327",
"refsource": "CONFIRM",
"url": "https://support.apple.com/kb/HT212327"
},
{
"name": "20210427 APPLE-SA-2021-04-26-3 Security Update 2021-002 Catalina",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Apr/51"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3838",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:51.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3839 (GCVE-0-2020-3839)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An application may be able to read restricted memory.
Severity
No CVSS data available.
CWE
- An application may be able to read restricted memory
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.apple.com/HT210919 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.242Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210919"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "macOS Catalina 10.15.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An application may be able to read restricted memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An application may be able to read restricted memory",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T20:45:04.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210919"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3839",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "macOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "macOS Catalina 10.15.3"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An application may be able to read restricted memory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "An application may be able to read restricted memory"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210919",
"refsource": "MISC",
"url": "https://support.apple.com/HT210919"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3839",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:51.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3840 (GCVE-0-2020-3840)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1. Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution.
Severity
No CVSS data available.
CWE
- Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://support.apple.com/HT210919 | x_refsource_MISC |
| https://support.apple.com/HT210918 | x_refsource_MISC |
| https://support.apple.com/HT210920 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.195Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210920"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "iOS 13.3.1 and iPadOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "macOS Catalina 10.15.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "tvOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1. Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T20:45:04.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210920"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3840",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "iOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "iOS 13.3.1 and iPadOS 13.3.1"
}
]
}
},
{
"product_name": "macOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "macOS Catalina 10.15.3"
}
]
}
},
{
"product_name": "tvOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "tvOS 13.3.1"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1. Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210919",
"refsource": "MISC",
"url": "https://support.apple.com/HT210919"
},
{
"name": "https://support.apple.com/HT210918",
"refsource": "MISC",
"url": "https://support.apple.com/HT210918"
},
{
"name": "https://support.apple.com/HT210920",
"refsource": "MISC",
"url": "https://support.apple.com/HT210920"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3840",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:51.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3841 (GCVE-0-2020-3841)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network.
Severity
No CVSS data available.
CWE
- A local user may unknowingly send a password unencrypted over the network
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.apple.com/HT210918 | x_refsource_MISC |
| https://support.apple.com/HT210922 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.215Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210922"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "iOS 13.3.1 and iPadOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "Safari 13.0.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A local user may unknowingly send a password unencrypted over the network",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T20:45:04.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210922"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3841",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "iOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "iOS 13.3.1 and iPadOS 13.3.1"
}
]
}
},
{
"product_name": "Safari",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "Safari 13.0.5"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "A local user may unknowingly send a password unencrypted over the network"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210918",
"refsource": "MISC",
"url": "https://support.apple.com/HT210918"
},
{
"name": "https://support.apple.com/HT210922",
"refsource": "MISC",
"url": "https://support.apple.com/HT210922"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3841",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:51.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3842 (GCVE-0-2020-3842)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
Severity
No CVSS data available.
CWE
- An application may be able to execute arbitrary code with kernel privileges
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://support.apple.com/HT210919 | x_refsource_MISC |
| https://support.apple.com/HT210918 | x_refsource_MISC |
| https://support.apple.com/HT210921 | x_refsource_MISC |
| https://support.apple.com/HT210920 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.179Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210921"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT210920"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "iOS 13.3.1 and iPadOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "macOS Catalina 10.15.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "tvOS 13.3.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "watchOS 6.1.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An application may be able to execute arbitrary code with kernel privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-27T20:45:04.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210919"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210918"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210921"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT210920"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3842",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "iOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "iOS 13.3.1 and iPadOS 13.3.1"
}
]
}
},
{
"product_name": "macOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "macOS Catalina 10.15.3"
}
]
}
},
{
"product_name": "tvOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "tvOS 13.3.1"
}
]
}
},
{
"product_name": "watchOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "watchOS 6.1.2"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "An application may be able to execute arbitrary code with kernel privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT210919",
"refsource": "MISC",
"url": "https://support.apple.com/HT210919"
},
{
"name": "https://support.apple.com/HT210918",
"refsource": "MISC",
"url": "https://support.apple.com/HT210918"
},
{
"name": "https://support.apple.com/HT210921",
"refsource": "MISC",
"url": "https://support.apple.com/HT210921"
},
{
"name": "https://support.apple.com/HT210920",
"refsource": "MISC",
"url": "https://support.apple.com/HT210920"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3842",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:51.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3843 (GCVE-0-2020-3843)
Vulnerability from cvelistv5 – Published: 2020-02-27 20:45 – Updated: 2024-08-04 07:44
VLAI
EPSS
Summary
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7, watchOS 5.3.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
Severity
No CVSS data available.
CWE
- A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://support.apple.com/HT211169 | x_refsource_MISC |
| https://support.apple.com/HT211176 | x_refsource_MISC |
| http://packetstormsecurity.com/files/162119/iOS-m… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:44:51.216Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT211169"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.apple.com/HT211176"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/162119/iOS-macOS-Radio-Proximity-Kernel-Memory-Corruption.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS-1",
"vendor": "Apple",
"versions": [
{
"lessThan": "iOS 12.4.7",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "watchOS-1",
"vendor": "Apple",
"versions": [
{
"lessThan": "watchOS 5.3.7",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7, watchOS 5.3.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A remote attacker may be able to cause unexpected system termination or corrupt kernel memory",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-07T23:06:26.000Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT211169"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.apple.com/HT211176"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/162119/iOS-macOS-Radio-Proximity-Kernel-Memory-Corruption.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product-security@apple.com",
"ID": "CVE-2020-3843",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "iOS-1",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "iOS 12.4.7"
}
]
}
},
{
"product_name": "watchOS-1",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "watchOS 5.3.7"
}
]
}
}
]
},
"vendor_name": "Apple"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7, watchOS 5.3.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "A remote attacker may be able to cause unexpected system termination or corrupt kernel memory"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.apple.com/HT211169",
"refsource": "MISC",
"url": "https://support.apple.com/HT211169"
},
{
"name": "https://support.apple.com/HT211176",
"refsource": "MISC",
"url": "https://support.apple.com/HT211176"
},
{
"name": "http://packetstormsecurity.com/files/162119/iOS-macOS-Radio-Proximity-Kernel-Memory-Corruption.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/162119/iOS-macOS-Radio-Proximity-Kernel-Memory-Corruption.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2020-3843",
"datePublished": "2020-02-27T20:45:04.000Z",
"dateReserved": "2019-12-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T07:44:51.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…