VAR-202010-1497
Vulnerability from variot - Updated: 2024-11-23 20:42A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.7. A malicious application may be able to read sensitive location information. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2020-11-13-7 Additional information for APPLE-SA-2020-09-24-1 macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave
macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave addresses the following issues. Information about the security content is also available at https://support.apple.com/HT211849.
CoreAudio Available for: macOS Catalina 10.15 Impact: Playing a malicious audio file may lead to arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2020-9986: Tim Kornhuber, Milan Stute and Alexander Heinrich of TU Darmstadt, Secure Mobile Networking Lab Entry added November 12, 2020
ImageIO Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-9961: Xingwei Lin of Ant Security Light-Year Lab Entry updated November 12, 2020
libxml2 Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6 Impact: Processing a maliciously crafted file may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-9981: found by OSS-Fuzz Entry added November 12, 2020
Mail Available for: macOS High Sierra 10.13.6 Impact: A remote attacker may be able to unexpectedly alter application state Description: This issue was addressed with improved checks. CVE-2020-9941: Fabian Ising of FH Münster University of Applied Sciences and Damian Poddebniak of FH Münster University of Applied Sciences
Model I/O Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15 Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-10011: Aleksandar Nikolic of Cisco Talos CVE-2020-9973: Aleksandar Nikolic of Cisco Talos Entry updated November 12, 2020
Model I/O Available for: macOS Mojave 10.14.6, macOS Catalina 10.15 Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-13520: Aleksandar Nikolic of Cisco Talos Entry added November 12, 2020
Sandbox Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15 Impact: A malicious application may be able to access restricted files Description: A logic issue was addressed with improved restrictions. CVE-2020-9968: Adam Chester(@xpn) of TrustedSec Entry updated November 12, 2020
Additional recognition
Bluetooth We would like to acknowledge Andy Davis of NCC Group for their assistance.
Installation note:
macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAl+uxoYACgkQZcsbuWJ6 jjCHdw//WLFqNbXU96dGvxxomfbZOJcbQJZNR2IfaJdfgyh7tXDM0iQ6u3pYiaE4 6ChayI2VZ7y0Aq0X8PkuIOCbin++/moGLuGrIEOYHaA9aiohD+YX9WMcKrk55B1K LBhZ9bBz2gPBzOUhVO63XW7nspS9tzhL+nyt1q4WeLbcYaLvEdV1ZJyrtQ7aBw1D RKFTKKxvOTgo+EdTq67zqWQNkTLdaz1Ls1NonDCVnd/p4M10Aa6iCUyA/q2OZFEL dmHAab1m+RBtkMCBaOXLlxQ09aBrBsJPQFRq0bH5btR1Od4GHyA+eXBmOLCggrM1 f64jsg/m9E+XgZ0OcBQ9X5Yh4kyBKw00EORGuSREAlvXl2WD87GlQzUpa53aMFf/ TjVEG79nWEWzxzNDFRPq6PXLrdbEUFizEEw0FffNPi4KjykntKtnQFJoqZiiWsSM Zmx7TI83KAdDYLusw5RYGhTb2fpfQKHLENnRpYvPC+b+pCyu+6RJC+mxHY2W9iAS K/yULJhphnQWyLO7kiiqLD1t77CDTUXNneei4WpS+L3SA7EjdcyLt/CZv4pBD2n1 /4RZXacoP1D7GabKK0DOB3tZHRqOuWa24NlkK3IzuejJJCbVhtji1yex7wU6gTW+ GEvH223424RO/8Kssd0/cgGfXQszDQLxZZIzooEUjxVcQ7tkxaI= =QB9p -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202010-1497",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.15.7"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.15"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"db": "NVD",
"id": "CVE-2020-9986"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "PACKETSTORM",
"id": "160065"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1246"
}
],
"trust": 0.7
},
"cve": "CVE-2020-9986",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2020-9986",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.1,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-010032",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-188111",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.8,
"id": "CVE-2020-9986",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 3.3,
"baseSeverity": "Low",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2020-010032",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-9986",
"trust": 1.0,
"value": "LOW"
},
{
"author": "NVD",
"id": "JVNDB-2020-010032",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNNVD",
"id": "CNNVD-202010-1246",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-188111",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2020-9986",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-188111"
},
{
"db": "VULMON",
"id": "CVE-2020-9986"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1246"
},
{
"db": "NVD",
"id": "CVE-2020-9986"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.7. A malicious application may be able to read sensitive location information. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2020-11-13-7 Additional information for\nAPPLE-SA-2020-09-24-1 macOS Catalina 10.15.7, Security\nUpdate 2020-005 High Sierra, Security Update 2020-005 Mojave\n\nmacOS Catalina 10.15.7, Security Update 2020-005 High Sierra,\nSecurity Update 2020-005 Mojave addresses the following issues. \nInformation about the security content is also available at\nhttps://support.apple.com/HT211849. \n\nCoreAudio\nAvailable for: macOS Catalina 10.15\nImpact: Playing a malicious audio file may lead to arbitrary code\nexecution\nDescription: A buffer overflow issue was addressed with improved\nmemory handling. \nCVE-2020-9986: Tim Kornhuber, Milan Stute and Alexander Heinrich of\nTU Darmstadt, Secure Mobile Networking Lab\nEntry added November 12, 2020\n\nImageIO\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS\nCatalina 10.15\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2020-9961: Xingwei Lin of Ant Security Light-Year Lab\nEntry updated November 12, 2020\n\nlibxml2\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\nImpact: Processing a maliciously crafted file may lead to arbitrary\ncode execution\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2020-9981: found by OSS-Fuzz\nEntry added November 12, 2020\n\nMail\nAvailable for: macOS High Sierra 10.13.6\nImpact: A remote attacker may be able to unexpectedly alter\napplication state\nDescription: This issue was addressed with improved checks. \nCVE-2020-9941: Fabian Ising of FH M\u00fcnster University of Applied\nSciences and Damian Poddebniak of FH M\u00fcnster University of Applied\nSciences\n\nModel I/O\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS\nCatalina 10.15\nImpact: Processing a maliciously crafted USD file may lead to\nunexpected application termination or arbitrary code execution\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2020-10011: Aleksandar Nikolic of Cisco Talos\nCVE-2020-9973: Aleksandar Nikolic of Cisco Talos\nEntry updated November 12, 2020\n\nModel I/O\nAvailable for: macOS Mojave 10.14.6, macOS Catalina 10.15\nImpact: Processing a maliciously crafted USD file may lead to\nunexpected application termination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking. \nCVE-2020-13520: Aleksandar Nikolic of Cisco Talos\nEntry added November 12, 2020\n\nSandbox\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS\nCatalina 10.15\nImpact: A malicious application may be able to access restricted\nfiles\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-9968: Adam Chester(@_xpn_) of TrustedSec\nEntry updated November 12, 2020\n\nAdditional recognition\n\nBluetooth\nWe would like to acknowledge Andy Davis of NCC Group for their\nassistance. \n\nInstallation note:\n\nmacOS Catalina 10.15.7, Security Update 2020-005 High Sierra,\nSecurity Update 2020-005 Mojave may be obtained from the Mac App\nStore or Apple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAl+uxoYACgkQZcsbuWJ6\njjCHdw//WLFqNbXU96dGvxxomfbZOJcbQJZNR2IfaJdfgyh7tXDM0iQ6u3pYiaE4\n6ChayI2VZ7y0Aq0X8PkuIOCbin++/moGLuGrIEOYHaA9aiohD+YX9WMcKrk55B1K\nLBhZ9bBz2gPBzOUhVO63XW7nspS9tzhL+nyt1q4WeLbcYaLvEdV1ZJyrtQ7aBw1D\nRKFTKKxvOTgo+EdTq67zqWQNkTLdaz1Ls1NonDCVnd/p4M10Aa6iCUyA/q2OZFEL\ndmHAab1m+RBtkMCBaOXLlxQ09aBrBsJPQFRq0bH5btR1Od4GHyA+eXBmOLCggrM1\nf64jsg/m9E+XgZ0OcBQ9X5Yh4kyBKw00EORGuSREAlvXl2WD87GlQzUpa53aMFf/\nTjVEG79nWEWzxzNDFRPq6PXLrdbEUFizEEw0FffNPi4KjykntKtnQFJoqZiiWsSM\nZmx7TI83KAdDYLusw5RYGhTb2fpfQKHLENnRpYvPC+b+pCyu+6RJC+mxHY2W9iAS\nK/yULJhphnQWyLO7kiiqLD1t77CDTUXNneei4WpS+L3SA7EjdcyLt/CZv4pBD2n1\n/4RZXacoP1D7GabKK0DOB3tZHRqOuWa24NlkK3IzuejJJCbVhtji1yex7wU6gTW+\nGEvH223424RO/8Kssd0/cgGfXQszDQLxZZIzooEUjxVcQ7tkxaI=\n=QB9p\n-----END PGP SIGNATURE-----\n\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-9986"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"db": "VULHUB",
"id": "VHN-188111"
},
{
"db": "VULMON",
"id": "CVE-2020-9986"
},
{
"db": "PACKETSTORM",
"id": "160065"
}
],
"trust": 1.89
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-9986",
"trust": 2.7
},
{
"db": "PACKETSTORM",
"id": "160065",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU92546061",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010032",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1246",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.3307.3",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2020-65939",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-188111",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2020-9986",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-188111"
},
{
"db": "VULMON",
"id": "CVE-2020-9986"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"db": "PACKETSTORM",
"id": "160065"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1246"
},
{
"db": "NVD",
"id": "CVE-2020-9986"
}
]
},
"id": "VAR-202010-1497",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-188111"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:42:41.055000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT211849",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT211849"
},
{
"title": "HT211849",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT211849"
},
{
"title": "Apple macOS Catalina Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=131697"
},
{
"title": "find-you",
"trust": 0.1,
"url": "https://github.com/positive-security/find-you "
},
{
"title": "OpenHayStack",
"trust": 0.1,
"url": "https://github.com/kal1gh0st/OpenHayStack "
},
{
"title": "openhaystack",
"trust": 0.1,
"url": "https://github.com/seemoo-lab/openhaystack "
},
{
"title": "OpenHayStack",
"trust": 0.1,
"url": "https://github.com/T-jatesada/OpenHayStack "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/youneselmoukhtari/airtag-zonder-Apple-s-restricties "
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/apples-location-system-expose-identities/164615/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-9986"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1246"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-9986"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://seclists.org/fulldisclosure/2020/nov/21"
},
{
"trust": 1.8,
"url": "https://support.apple.com/kb/ht211849"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9986"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-9986"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu92546061/index.html"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht211849"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/160065/apple-security-advisory-2020-11-13-7.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3307.3/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://github.com/positive-security/find-you"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://threatpost.com/apples-location-system-expose-identities/164615/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-10011"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-13520"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9981"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9961"
},
{
"trust": 0.1,
"url": "https://support.apple.com/ht211849."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9954"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://support.apple.com/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9941"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9968"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9973"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-188111"
},
{
"db": "VULMON",
"id": "CVE-2020-9986"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"db": "PACKETSTORM",
"id": "160065"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1246"
},
{
"db": "NVD",
"id": "CVE-2020-9986"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-188111"
},
{
"db": "VULMON",
"id": "CVE-2020-9986"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"db": "PACKETSTORM",
"id": "160065"
},
{
"db": "CNNVD",
"id": "CNNVD-202010-1246"
},
{
"db": "NVD",
"id": "CVE-2020-9986"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-10-22T00:00:00",
"db": "VULHUB",
"id": "VHN-188111"
},
{
"date": "2020-10-22T00:00:00",
"db": "VULMON",
"id": "CVE-2020-9986"
},
{
"date": "2020-12-17T08:43:27",
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"date": "2020-11-15T15:22:22",
"db": "PACKETSTORM",
"id": "160065"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202010-1246"
},
{
"date": "2020-10-22T19:15:15.900000",
"db": "NVD",
"id": "CVE-2020-9986"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-05-24T00:00:00",
"db": "VULHUB",
"id": "VHN-188111"
},
{
"date": "2022-05-24T00:00:00",
"db": "VULMON",
"id": "CVE-2020-9986"
},
{
"date": "2020-12-17T08:43:27",
"db": "JVNDB",
"id": "JVNDB-2020-010032"
},
{
"date": "2021-10-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202010-1246"
},
{
"date": "2024-11-21T05:41:38.880000",
"db": "NVD",
"id": "CVE-2020-9986"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202010-1246"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "macOS Catalina File access vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010032"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202010-1246"
}
],
"trust": 0.6
}
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.