var-202002-1153
Vulnerability from variot
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing a maliciously crafted image may lead to arbitrary code execution. plural Apple An out-of-bounds read vulnerability exists in the product due to a flaw in the input validation process.Arbitrary code can be executed by processing maliciously created images. Apple tvOS and others are all products of Apple (Apple). Apple tvOS is a smart TV operating system. Apple watchOS is a smart watch operating system. Apple macOS Catalina is a dedicated operating system developed for Mac computers. A security vulnerability exists in the ImageIO component of several Apple products. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra
macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following:
AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative
apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043
Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team
autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka)
CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab
CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab
Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit)
Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero
ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero
Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team
IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero
IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo
Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero
Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite
Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero
Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero
Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium
libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela
libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero
libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero
PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit)
Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg
sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple
System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit)
Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative
Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero
wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb)
Additional recognition
Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance.
Installation note:
macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202002-1153",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.3.1"
},
{
"model": "watchos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "6.1.2"
},
{
"model": "ipados",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.3.1"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.3.1"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.15.3"
},
{
"model": "itunes",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.10.4"
},
{
"model": "icloud",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.3.1 \u672a\u6e80 (ipod touch \u7b2c 7 \u4e16\u4ee3)"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.3.1 \u672a\u6e80 (iphone 6s \u4ee5\u964d)"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.13.6"
},
{
"model": "ipados",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.3.1 \u672a\u6e80 (ipad air 2 \u4ee5\u964d)"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.14.6"
},
{
"model": "icloud",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "for windows 7.17 \u672a\u6e80 (windows 7 \u4ee5\u964d)"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.3.1 \u672a\u6e80 (apple tv hd)"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.3.1 \u672a\u6e80 (apple tv 4k)"
},
{
"model": "ipados",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "13.3.1 \u672a\u6e80 (ipad mini 4 \u4ee5\u964d)"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "for windows 12.10.4 \u672a\u6e80 (windows 7 \u4ee5\u964d)"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "6.1.2 \u672a\u6e80 (apple watch series 1 \u4ee5\u964d )"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.15.2"
},
{
"model": "icloud",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "for windows 10.9.2 \u672a\u6e80 (windows 10 \u4ee5\u964d)"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"db": "NVD",
"id": "CVE-2020-3826"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "11.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "12.10.4",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.3.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.3.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.15.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.3.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.1.2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-3826"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Samuel Gro\u00df of Google Project Zero,saelo, Google Security Research",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
],
"trust": 0.6
},
"cve": "CVE-2020-3826",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-002305",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-181951",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-002305",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-3826",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2020-002305",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202001-1414",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-181951",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-181951"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"db": "NVD",
"id": "CVE-2020-3826"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing a maliciously crafted image may lead to arbitrary code execution. plural Apple An out-of-bounds read vulnerability exists in the product due to a flaw in the input validation process.Arbitrary code can be executed by processing maliciously created images. Apple tvOS and others are all products of Apple (Apple). Apple tvOS is a smart TV operating system. Apple watchOS is a smart watch operating system. Apple macOS Catalina is a dedicated operating system developed for Mac computers. A security vulnerability exists in the ImageIO component of several Apple products. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update\n2020-001 Mojave, Security Update 2020-001 High Sierra\n\nmacOS Catalina 10.15.3, Security Update 2020-001 Mojave, and\nSecurity Update 2020-001 High Sierra are now available and\naddress the following:\n\nAnnotationKit\nAvailable for: macOS Catalina 10.15.2\nImpact: A remote attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2020-3877: an anonymous researcher working with Trend Micro\u0027s\nZero Day Initiative\n\napache_mod_php\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: Multiple issues in PHP\nDescription: Multiple issues were addressed by updating to PHP\nversion 7.3.11. \nCVE-2019-11043\n\nAudio\nAvailable for: macOS Catalina 10.15.2\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team\n\nautofs\nAvailable for: macOS Catalina 10.15.2\nImpact: Searching for and opening a file from an attacker controlled\nNFS mount may bypass Gatekeeper\nDescription: This was addressed with additional checks by Gatekeeper\non files mounted through a network share. \nCVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and Ren\u00e9 Kroka\n(@rene_kroka)\n\nCoreBluetooth\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\nImpact: A remote attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab\nCVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab\nCVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab\n\nCoreBluetooth\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\nImpact: A remote attacker may be able to leak memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab\n\nCrash Reporter\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: A malicious application may be able to access restricted\nfiles\nDescription: A validation issue existed in the handling of symlinks. \nCVE-2020-3835: Csaba Fitzl (@theevilbit)\n\nImage Processing\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: Viewing a maliciously crafted JPEG file may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2020-3827: Samuel Gro\u00df of Google Project Zero\n\nImageIO\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2020-3826: Samuel Gro\u00df of Google Project Zero\nCVE-2020-3870\nCVE-2020-3878: Samuel Gro\u00df of Google Project Zero\n\nIntel Graphics Driver\nAvailable for: macOS Mojave 10.14.6, macOS Catalina 10.15.2\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team\n\nIOAcceleratorFamily\nAvailable for: macOS Catalina 10.15.2\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2020-3837: Brandon Azad of Google Project Zero\n\nIPSec\nAvailable for: macOS Catalina 10.15.2\nImpact: Loading a maliciously crafted racoon configuration file may\nlead to arbitrary code execution\nDescription: An off by one issue existed in the handling of racoon\nconfiguration files. \nCVE-2020-3840: @littlelailo\n\nKernel\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2020-3875: Brandon Azad of Google Project Zero\n\nKernel\nAvailable for: macOS Catalina 10.15.2\nImpact: An application may be able to read restricted memory\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2020-3872: Haakon Garseg M\u00f8rk of Cognite and Cim Stordal of\nCognite\n\nKernel\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: A malicious application may be able to execute arbitrary code\nwith system privileges\nDescription: A type confusion issue was addressed with improved\nmemory handling. \nCVE-2020-3853: Brandon Azad of Google Project Zero\n\nKernel\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: A malicious application may be able to determine kernel\nmemory layout\nDescription: An access issue was addressed with improved memory\nmanagement. \nCVE-2020-3836: Brandon Azad of Google Project Zero\n\nKernel\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2020-3842: Ned Williamson working with Google Project Zero\nCVE-2020-3871: Corellium\n\nlibxml2\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\nImpact: Processing maliciously crafted XML may lead to an unexpected\napplication termination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved size\nvalidation. \nCVE-2020-3846: Ranier Vilela\n\nlibxpc\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: Processing a maliciously crafted string may lead to heap\ncorruption\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2020-3856: Ian Beer of Google Project Zero\n\nlibxpc\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: An application may be able to gain elevated privileges\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2020-3829: Ian Beer of Google Project Zero\n\nPackageKit\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: A malicious application may be able to overwrite arbitrary\nfiles\nDescription: A validation issue existed in the handling of symlinks. \nCVE-2020-3830: Csaba Fitzl (@theevilbit)\n\nSecurity\nAvailable for: macOS Catalina 10.15.2\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger\nof the Security in Distributed Systems Group of University of Hamburg\n\nsudo\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: Certain configurations may allow a local attacker to execute\narbitrary code\nDescription: A buffer overflow issue was addressed with improved\nmemory handling. \nCVE-2019-18634: Apple\n\nSystem\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\nImpact: A malicious application may be able to overwrite arbitrary\nfiles\nDescription: An access issue was addressed with improved access\nrestrictions. \nCVE-2020-3855: Csaba Fitzl (@theevilbit)\n\nWi-Fi\nAvailable for: macOS Catalina 10.15.2\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2020-3839: s0ngsari of Theori and Lee of Seoul National\nUniversity working with Trend Micro\u0027s Zero Day Initiative\n\nWi-Fi\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2020-3843: Ian Beer of Google Project Zero\n\nwifivelocityd\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15.2\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: The issue was addressed with improved permissions logic. \nCVE-2020-3838: Dayton Pidhirney (@_watbulb)\n\nAdditional recognition\n\nPhotos Storage\nWe would like to acknowledge Salman Husain of UC Berkeley for their\nassistance. \n\nInstallation note:\n\nmacOS Catalina 10.15.3, Security Update 2020-001 Mojave, and\nSecurity Update 2020-001 High Sierra may be obtained from the\nMac App Store or Apple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y\n0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ\nhErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU\nGQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv\nyg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M\n35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c\n8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen\nGS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf\n2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz\nTCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p\niZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT\n1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w=\n=toYN\n-----END PGP SIGNATURE-----=\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-3826"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"db": "VULHUB",
"id": "VHN-181951"
},
{
"db": "PACKETSTORM",
"id": "156153"
},
{
"db": "PACKETSTORM",
"id": "156131"
},
{
"db": "PACKETSTORM",
"id": "156152"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-3826",
"trust": 2.8
},
{
"db": "JVN",
"id": "JVNVU95678717",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-002305",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1414",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "156252",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.0351",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2020-15556",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-181951",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "156153",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "156131",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "156152",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-181951"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"db": "PACKETSTORM",
"id": "156153"
},
{
"db": "PACKETSTORM",
"id": "156131"
},
{
"db": "PACKETSTORM",
"id": "156152"
},
{
"db": "NVD",
"id": "CVE-2020-3826"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
]
},
"id": "VAR-202002-1153",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-181951"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:18:54.596000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT210921",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht210921"
},
{
"title": "HT210923",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht210923"
},
{
"title": "HT210947",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht210947"
},
{
"title": "HT210948",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht210948"
},
{
"title": "HT210918",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht210918"
},
{
"title": "HT210919",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht210919"
},
{
"title": "HT210920",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht210920"
},
{
"title": "HT210923",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht210923"
},
{
"title": "HT210947",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht210947"
},
{
"title": "HT210948",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht210948"
},
{
"title": "HT210918",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht210918"
},
{
"title": "HT210919",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht210919"
},
{
"title": "HT210920",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht210920"
},
{
"title": "HT210921",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht210921"
},
{
"title": "Multiple Apple product ImageIO Fix for component buffer error vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=110872"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-125",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-181951"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"db": "NVD",
"id": "CVE-2020-3826"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://support.apple.com/ht210947"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210948"
},
{
"trust": 1.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3826"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3826"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu95678717/"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht210919"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-31449"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht210947"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.0351/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/156252/macos-ios-imageio-dds-image-out-of-bounds-read.html"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht210921"
},
{
"trust": 0.3,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.3,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3846"
},
{
"trust": 0.2,
"url": "https://support.apple.com/ht204283"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3825"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3865"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3867"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3868"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3862"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3839"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3849"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-11043"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3835"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3842"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3837"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3845"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3870"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3827"
},
{
"trust": 0.1,
"url": "https://support.apple.com/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3848"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3856"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-18634"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3866"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3857"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3840"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3871"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3855"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3850"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3854"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3853"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3843"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3847"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3838"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3830"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3836"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3829"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-181951"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"db": "PACKETSTORM",
"id": "156153"
},
{
"db": "PACKETSTORM",
"id": "156131"
},
{
"db": "PACKETSTORM",
"id": "156152"
},
{
"db": "NVD",
"id": "CVE-2020-3826"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-181951"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"db": "PACKETSTORM",
"id": "156153"
},
{
"db": "PACKETSTORM",
"id": "156131"
},
{
"db": "PACKETSTORM",
"id": "156152"
},
{
"db": "NVD",
"id": "CVE-2020-3826"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-02-27T00:00:00",
"db": "VULHUB",
"id": "VHN-181951"
},
{
"date": "2020-03-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"date": "2020-01-30T14:46:35",
"db": "PACKETSTORM",
"id": "156153"
},
{
"date": "2020-01-29T17:17:36",
"db": "PACKETSTORM",
"id": "156131"
},
{
"date": "2020-01-30T14:46:23",
"db": "PACKETSTORM",
"id": "156152"
},
{
"date": "2020-02-27T21:15:15.913000",
"db": "NVD",
"id": "CVE-2020-3826"
},
{
"date": "2020-01-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-03-02T00:00:00",
"db": "VULHUB",
"id": "VHN-181951"
},
{
"date": "2020-03-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-002305"
},
{
"date": "2020-03-02T20:30:54.817000",
"db": "NVD",
"id": "CVE-2020-3826"
},
{
"date": "2021-11-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Apple Out-of-bounds read vulnerabilities in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-002305"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202001-1414"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.