var-202004-1982
Vulnerability from variot

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Multiple issues in libxml2. plural Apple A buffer overflow vulnerability exists in the product due to a flawed boundary check.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. libxml2 is one of the XML document parsing libraries. A remote attacker could use a specially crafted XML file to exploit this vulnerability to execute arbitrary code or cause the application to crash. The following products and versions are affected: Windows-based Apple iCloud versions prior to 7.18 and 10.9.3; Windows-based iTunes versions prior to 12.10.5; iOS versions prior to 13.4; iPadOS versions prior to 13.4; watchOS versions prior to 6.2; tvOS Versions prior to 13.4; versions prior to macOS Catalina 10.15.4.

Alternatively, on your watch, select "My Watch > General > About". CVE-2020-3892: Yu Wang of Didi Research America CVE-2020-3893: Yu Wang of Didi Research America CVE-2020-3905: Yu Wang of Didi Research America

Call History Available for: macOS Catalina 10.15.3 Impact: A malicious application may be able to access a user's call history Description: This issue was addressed with a new entitlement. CVE-2020-3851: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc. CVE-2020-3884: Apple

sudo Available for: macOS Catalina 10.15.3 Impact: An attacker may be able to run commands as a non-existent user Description: This issue was addressed by updating to sudo version 1.8.31. CVE-2020-3906: Patrick Wardle of Jamf

Vim Available for: macOS Catalina 10.15.3 Impact: Multiple issues in Vim Description: Multiple issues were addressed by updating to version 8.1.1850.

FireWire Audio We would like to acknowledge Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc. and Luyi Xing of Indiana University Bloomington for their assistance.

Install Framework Legacy We would like to acknowledge Pris Sears of Virginia Tech, Tom Lynch of UAL Creative Computing Institute, and an anonymous researcher for their assistance.

Installation note:

macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ -----BEGIN PGP SIGNATURE----- Version: BCPG v1.64

iQIcBAEDCAAGBQJeejDOAAoJEAc+Lhnt8tDNTtkP/RRnnsXeWXRjFHoRf7P+npKE Je0ZSoqv08Tgmv+Q0voSdCFZjFAqKXviVgZTGFT7LsuUWqdZEATxkB1fevt7t3Bl qXWNGpna3mGqWl6I2cWKxVOHT9fysO/31ADgFIwgOWSodvImNdp/JBpOcyRqcFJc B3TpNq8xtKSpWBVrq0TVHRWMu87VJHkGi78jAJ4x7qgXyWICf3usa9ajqYqzV99m 6/DrIH4s2Um2zJVi4YyzK0+rR2B2Q1eO8CFuzUB9D1HKCEnRXoRfALFC8v83p7cC m46CarISSrnMEYkxNhxsOGQbcMyBR3GDNZlo8/Y+Syqgwp3AKWbRFUDDM9vbCv6F z1fkWBmGftcd6G8dqO0dMAR6asglg9z2/GF/+3pZh5Mmmd7EBX+YeA84BhDTTsTs 671Af+F8OxSqgRV8qe+dbiFbD9qylM1luJD98PzoiFMO3h29fS41ofpuA6BTrdQN JPWY0NwTS11xQb11LHhXm7nF9vsrCIIspauOfkLbpCx6AWJQ/FpPyIXBYUEJ50ho NWWv4jmT+v8PSC2tSM0yMeI4OJX/+yd91uKLqzGGr1x2zshrXoMx0VDpg8HJkLfT y7CSgFrBGO8AgrcsZ6I8nDleoBsrEpLh2qEil7GexwoyUrVvfxCueW0shv4Oo4gf ZHp7Jd+FZIoCP69dNnxG =AUHy -----END PGP SIGNATURE-----

. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

APPLE-SA-2020-03-24-1 iOS 13.4 and iPadOS 13.4

iOS 13.4 and iPadOS 13.4 are now available and address the following:

ActionKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to use an SSH client provided by private frameworks Description: This issue was addressed with a new entitlement. CVE-2020-3917: Steven Troughton-Smith (@stroughtonsmith)

AppleMobileFileIntegrity Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to use arbitrary entitlements Description: This issue was addressed with improved checks. CVE-2020-3883: Linus Henze (pinauten.de)

Bluetooth Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic Description: A logic issue was addressed with improved state management. CVE-2020-9770: Jianliang Wu of PurSec Lab of Purdue University, Xinwen Fu and Yue Zhang of the University of Central Florida

CoreFoundation Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to elevate privileges Description: A permissions issue existed. CVE-2020-3913: Timo Christ of Avira Operations GmbH & Co. KG

Icons Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Setting an alternate app icon may disclose a photo without needing permission to access photos Description: An access issue was addressed with additional sandbox restrictions. CVE-2020-3916: Vitaliy Alekseev (@villy21)

Icons Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to identify what other applications a user has installed Description: The issue was addressed with improved handling of icon caches. CVE-2020-9773: Chilik Tamir of Zimperium zLabs

Image Processing Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A use after free issue was addressed with improved memory management. CVE-2020-9768: Mohamed Ghannam (@_simo36)

IOHIDFamily Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3919: an anonymous researcher

Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3914: pattern-f (@pattern_F_) of WaCai

Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed with improved state management. CVE-2020-9785: Proteas of Qihoo 360 Nirvan Team

libxml2 Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Multiple issues in libxml2 Description: A buffer overflow was addressed with improved size validation. CVE-2020-3910: LGTM.com

libxml2 Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Multiple issues in libxml2 Description: A buffer overflow was addressed with improved bounds checking. CVE-2020-3909: LGTM.com CVE-2020-3911: found by OSS-Fuzz

Mail Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A local user may be able to view deleted content in the app switcher Description: The issue was resolved by clearing application previews when content is deleted. CVE-2020-9780: an anonymous researcher, Dimitris Chaintinis

Mail Attachments Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Cropped videos may not be shared properly via Mail Description: An issue existed in the selection of video file by Mail. The issue was fixed by selecting the latest version of a video. CVE-2020-9777

Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to a locked iOS device may be able to respond to messages even when replies are disabled Description: A logic issue was addressed with improved state management. CVE-2020-3891: Peter Scott

Messages Composition Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Deleted messages groups may still be suggested as an autocompletion Description: The issue was addressed with improved deletion. CVE-2020-3890: an anonymous researcher

Safari Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A user's private browsing activity may be unexpectedly saved in Screen Time Description: An issue existed in the handling of tabs displaying picture in picture video. The issue was corrected with improved state handling. CVE-2020-9775: an anonymous researcher, Marek Wawro (futurefinance.com) and Sambor Wawro of STO64 School Krakow Poland

Safari Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A user may grant website permissions to a site they didn't intend to Description: The issue was addressed by clearing website permission prompts after navigation. CVE-2020-9781: Nikhil Mittal (@c0d3G33k) of Payatu Labs (payatu.com)

Web App Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A maliciously crafted page may interfere with other web contexts Description: A logic issue was addressed with improved restrictions. CVE-2020-3888: Darren Jones of Dappological Ltd.

WebKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A race condition was addressed with additional validation. CVE-2020-3894: Sergei Glazunov of Google Project Zero

WebKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A remote attacker may be able to cause arbitrary code execution Description: A memory consumption issue was addressed with improved memory handling. CVE-2020-3899: found by OSS-Fuzz

WebKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: An input validation issue was addressed with improved input validation. CVE-2020-3902: Yiğit Can YILMAZ (@yilmazcanyigit)

WebKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3895: grigoritchy CVE-2020-3900: Dongzhuo Zhao working with ADLab of Venustech

WebKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3901: Benjamin Randazzo (@____benjamin)

WebKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A download's origin may be incorrectly associated Description: A logic issue was addressed with improved restrictions. CVE-2020-3887: Ryan Pickren (ryanpickren.com)

WebKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing maliciously crafted web content may lead to code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-9783: Apple

WebKit Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A remote attacker may be able to cause arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3897: Brendan Draper (@6r3nd4n) working with Trend Micro’s Zero Day Initiative

WebKit Page Loading Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A file URL may be incorrectly processed Description: A logic issue was addressed with improved restrictions. CVE-2020-3885: Ryan Pickren (ryanpickren.com)

Additional recognition

FontParser We would like to acknowledge Matthew Denton of Google Chrome for their assistance.

Kernel We would like to acknowledge Siguza for their assistance.

LinkPresentation We would like to acknowledge Travis for their assistance.

Notes We would like to acknowledge Mike DiLoreto for their assistance.

rapportd We would like to acknowledge Alexander Heinrich (@Sn0wfreeze) of Technische Universität Darmstadt for their assistance.

Safari Reader We would like to acknowledge Nikhil Mittal (@c0d3G33k) of Payatu Labs (payatu.com) for their assistance.

Sidecar We would like to acknowledge Rick Backley (@rback_sec) for their assistance.

SiriKit We would like to acknowledge Ioan Florescu and Ki Ha Nam for their assistance.

WebKit We would like to acknowledge Emilio Cobos Álvarez of Mozilla, Samuel Groß of Google Project Zero, and an anonymous researcher for their assistance.

Installation note:

This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/

iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.

The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.

To check that the iPhone, iPod touch, or iPad has been updated:

  • Navigate to Settings
  • Select General
  • Select About. The version after applying this update will be "iOS 13.4 and iPadOS 13.4".

-----BEGIN PGP SIGNATURE----- Version: BCPG v1.64

iQIcBAEDCAAGBQJeekZMAAoJEAc+Lhnt8tDNKCgP/3pVmWn5xSJ/VS0kgOY3XsuF dy80y4fIR+0y0Gx2t06RY/5fROnZWYpCs7TjWg0ZoWF73wplM6nfR19QaS0evqrK KJq46grrKHnhgrmSqCzNiar5uYm6/S3BLCueikeqAX2osMOI/rmWGy0/BFxgv6vL OS6n9n6NO0V9wQQdnOveWMARi0w9M3S07j86T4OUNEw49Z3dNcndP6HYxagQAP1Y 7O26ls+HkgH7mbHxvUN0WqtmTCaOgB4pXeTCrd4d/ev1LTiO4NH00DcaC6a2adhD c7TZO9Ba5H15XVVpkPQqFfiKVfjvQcPrTmKk0mdaLnDOB2ntUnvKplCeZPTFefGw ZidI9SYUnPWJ4ITxji48PcRhbHALW59PYnhHvRRfxyqYhwsNus9i3UZNXkjm5U0D hdDevEztCnkAsqZWq9hvCwDrsIvvlGrueuCC6jqODSNWucod/inOvGZ2N0/rwc/r UtlGyZtQj9rWvZix0daOEWYnwSoV09XuIhUlcEEG/CU1XlVOCAD01n02zIGcLc2C Rm/61L08KcRDRvBLsNEYDgfnvxj2Lsyi2wf8L0VGpkHJkoDifLh64fPYshjhL6t5 OeKelaH5yPeTdu2bs4ispTmlUJ9NYVHxyDeWGdtz4sfCFAji+pK9uFHFh3woVs6U QZLTM48mlSBSN+txWmsZ =K2in -----END PGP SIGNATURE-----

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202004-1982",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "icloud",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.9.3"
      },
      {
        "model": "ipados",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "13.4"
      },
      {
        "model": "icloud",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "7.18"
      },
      {
        "model": "iphone os",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "13.4"
      },
      {
        "model": "itunes",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "12.10.5"
      },
      {
        "model": "sun zfs storage appliance kit software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.8"
      },
      {
        "model": "watchos",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "6.2"
      },
      {
        "model": "tvos",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "13.4"
      },
      {
        "model": "icloud",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.9"
      },
      {
        "model": "mac os x",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.15.4"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "13.4 \u672a\u6e80 (ipod touch \u7b2c 7 \u4e16\u4ee3)"
      },
      {
        "model": "ipados",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "13.4 \u672a\u6e80 (ipad air 2 \u4ee5\u964d)"
      },
      {
        "model": "icloud",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "for windows 7.18 \u672a\u6e80 (windows 10 \u4ee5\u964d)"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "10.13.6"
      },
      {
        "model": "icloud",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "for windows 10.9.3 \u672a\u6e80 (windows 7 \u4ee5\u964d)"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "10.14.6"
      },
      {
        "model": "itunes",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "for windows 12.10.5 \u672a\u6e80 (windows 7 \u4ee5\u964d)"
      },
      {
        "model": "tvos",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "13.4 \u672a\u6e80 (apple tv 4k)"
      },
      {
        "model": "ipados",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "13.4 \u672a\u6e80 (ipad mini 4 \u4ee5\u964d)"
      },
      {
        "model": "watchos",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "6.4 \u672a\u6e80 (apple watch series 1 \u4ee5\u964d)"
      },
      {
        "model": "tvos",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "13.4 \u672a\u6e80 (apple tv hd)"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "13.4  \u672a\u6e80 (iphone 6s \u4ee5\u964d)"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "10.15.3"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-3909"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "10.15.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "12.10.5",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.18",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndExcluding": "10.9.3",
                "versionStartIncluding": "10.9",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit_software:8.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-3909"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "156900"
      },
      {
        "db": "PACKETSTORM",
        "id": "156894"
      },
      {
        "db": "PACKETSTORM",
        "id": "156947"
      },
      {
        "db": "PACKETSTORM",
        "id": "156906"
      },
      {
        "db": "PACKETSTORM",
        "id": "156946"
      },
      {
        "db": "PACKETSTORM",
        "id": "156896"
      },
      {
        "db": "PACKETSTORM",
        "id": "156892"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-3909",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-003577",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-182034",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-003577",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-3909",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-003577",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202003-1570",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-182034",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-182034"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-3909"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Multiple issues in libxml2. plural Apple A buffer overflow vulnerability exists in the product due to a flawed boundary check.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. libxml2 is one of the XML document parsing libraries. A remote attacker could use a specially crafted XML file to exploit this vulnerability to execute arbitrary code or cause the application to crash. The following products and versions are affected: Windows-based Apple iCloud versions prior to 7.18 and 10.9.3; Windows-based iTunes versions prior to 12.10.5; iOS versions prior to 13.4; iPadOS versions prior to 13.4; watchOS versions prior to 6.2; tvOS Versions prior to 13.4; versions prior to macOS Catalina 10.15.4. \n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\". \nCVE-2020-3892: Yu Wang of Didi Research America\nCVE-2020-3893: Yu Wang of Didi Research America\nCVE-2020-3905: Yu Wang of Didi Research America\n\nCall History\nAvailable for: macOS Catalina 10.15.3\nImpact: A malicious application may be able to access a user\u0027s call\nhistory\nDescription: This issue was addressed with a new entitlement. \nCVE-2020-3851: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc. \nCVE-2020-3884: Apple\n\nsudo\nAvailable for: macOS Catalina 10.15.3\nImpact: An attacker may be able to run commands as a non-existent\nuser\nDescription: This issue was addressed by updating to sudo version\n1.8.31. \nCVE-2020-3906: Patrick Wardle of Jamf\n\nVim\nAvailable for: macOS Catalina 10.15.3\nImpact: Multiple issues in Vim\nDescription: Multiple issues were addressed by updating to version\n8.1.1850. \n\nFireWire Audio\nWe would like to acknowledge Xiaolong Bai and Min (Spark) Zheng of\nAlibaba Inc. and Luyi Xing of Indiana University Bloomington for\ntheir assistance. \n\nInstall Framework Legacy\nWe would like to acknowledge Pris Sears of Virginia Tech, Tom Lynch\nof UAL Creative Computing Institute, and an anonymous researcher for\ntheir assistance. \n\nInstallation note:\n\nmacOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security\nUpdate 2020-002 High Sierra may be obtained from the Mac App Store or\nApple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n-----BEGIN PGP SIGNATURE-----\nVersion: BCPG v1.64\n\niQIcBAEDCAAGBQJeejDOAAoJEAc+Lhnt8tDNTtkP/RRnnsXeWXRjFHoRf7P+npKE\nJe0ZSoqv08Tgmv+Q0voSdCFZjFAqKXviVgZTGFT7LsuUWqdZEATxkB1fevt7t3Bl\nqXWNGpna3mGqWl6I2cWKxVOHT9fysO/31ADgFIwgOWSodvImNdp/JBpOcyRqcFJc\nB3TpNq8xtKSpWBVrq0TVHRWMu87VJHkGi78jAJ4x7qgXyWICf3usa9ajqYqzV99m\n6/DrIH4s2Um2zJVi4YyzK0+rR2B2Q1eO8CFuzUB9D1HKCEnRXoRfALFC8v83p7cC\nm46CarISSrnMEYkxNhxsOGQbcMyBR3GDNZlo8/Y+Syqgwp3AKWbRFUDDM9vbCv6F\nz1fkWBmGftcd6G8dqO0dMAR6asglg9z2/GF/+3pZh5Mmmd7EBX+YeA84BhDTTsTs\n671Af+F8OxSqgRV8qe+dbiFbD9qylM1luJD98PzoiFMO3h29fS41ofpuA6BTrdQN\nJPWY0NwTS11xQb11LHhXm7nF9vsrCIIspauOfkLbpCx6AWJQ/FpPyIXBYUEJ50ho\nNWWv4jmT+v8PSC2tSM0yMeI4OJX/+yd91uKLqzGGr1x2zshrXoMx0VDpg8HJkLfT\ny7CSgFrBGO8AgrcsZ6I8nDleoBsrEpLh2qEil7GexwoyUrVvfxCueW0shv4Oo4gf\nZHp7Jd+FZIoCP69dNnxG\n=AUHy\n-----END PGP SIGNATURE-----\n\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2020-03-24-1 iOS 13.4 and iPadOS 13.4\n\niOS 13.4 and iPadOS 13.4 are now available and address the following:\n\nActionKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: An application may be able to use an SSH client provided by\nprivate frameworks\nDescription: This issue was addressed with a new entitlement. \nCVE-2020-3917: Steven Troughton-Smith (@stroughtonsmith)\n\nAppleMobileFileIntegrity\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: An application may be able to use arbitrary entitlements\nDescription: This issue was addressed with improved checks. \nCVE-2020-3883: Linus Henze (pinauten.de)\n\nBluetooth\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: An attacker in a privileged network position may be able to\nintercept Bluetooth traffic\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2020-9770: Jianliang Wu of PurSec Lab of Purdue University,\nXinwen Fu and Yue Zhang of the University of Central Florida\n\nCoreFoundation\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A malicious application may be able to elevate privileges\nDescription: A permissions issue existed. \nCVE-2020-3913: Timo Christ of Avira Operations GmbH \u0026 Co. KG\n\nIcons\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Setting an alternate app icon may disclose a photo without\nneeding permission to access photos\nDescription: An access issue was addressed with additional sandbox\nrestrictions. \nCVE-2020-3916: Vitaliy Alekseev (@villy21)\n\nIcons\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A malicious application may be able to identify what other\napplications a user has installed\nDescription: The issue was addressed with improved handling of icon\ncaches. \nCVE-2020-9773: Chilik Tamir of Zimperium zLabs\n\nImage Processing\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2020-9768: Mohamed Ghannam (@_simo36)\n\nIOHIDFamily\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2020-3919: an anonymous researcher\n\nKernel\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: An application may be able to read restricted memory\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2020-3914: pattern-f (@pattern_F_) of WaCai\n\nKernel\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: Multiple memory corruption issues were addressed with\nimproved state management. \nCVE-2020-9785: Proteas of Qihoo 360 Nirvan Team\n\nlibxml2\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Multiple issues in libxml2\nDescription: A buffer overflow was addressed with improved size\nvalidation. \nCVE-2020-3910: LGTM.com\n\nlibxml2\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Multiple issues in libxml2\nDescription: A buffer overflow was addressed with improved bounds\nchecking. \nCVE-2020-3909: LGTM.com\nCVE-2020-3911: found by OSS-Fuzz\n\nMail\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A local user may be able to view deleted content in the app\nswitcher\nDescription: The issue was resolved by clearing application previews\nwhen content is deleted. \nCVE-2020-9780: an anonymous researcher, Dimitris Chaintinis\n\nMail Attachments\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Cropped videos may not be shared properly via Mail\nDescription: An issue existed in the selection of video file by Mail. \nThe issue was fixed by selecting the latest version of a video. \nCVE-2020-9777\n\nMessages\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A person with physical access to a locked iOS device may be\nable to respond to messages even when replies are disabled\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2020-3891: Peter Scott\n\nMessages Composition\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Deleted messages groups may still be suggested as an\nautocompletion\nDescription: The issue was addressed with improved deletion. \nCVE-2020-3890: an anonymous researcher\n\nSafari\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A user\u0027s private browsing activity may be unexpectedly saved\nin Screen Time\nDescription: An issue existed in the handling of tabs displaying\npicture in picture video. The issue was corrected with improved state\nhandling. \nCVE-2020-9775: an anonymous researcher, Marek Wawro\n(futurefinance.com) and Sambor Wawro of STO64 School Krakow Poland\n\nSafari\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A user may grant website permissions to a site they didn\u0027t\nintend to\nDescription: The issue was addressed by clearing website permission\nprompts after navigation. \nCVE-2020-9781: Nikhil Mittal (@c0d3G33k) of Payatu Labs (payatu.com)\n\nWeb App\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A maliciously crafted page may interfere with other web\ncontexts\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-3888: Darren Jones of Dappological Ltd. \n\nWebKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: An application may be able to read restricted memory\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2020-3894: Sergei Glazunov of Google Project Zero\n\nWebKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: A memory consumption issue was addressed with improved\nmemory handling. \nCVE-2020-3899: found by OSS-Fuzz\n\nWebKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Processing maliciously crafted web content may lead to a\ncross site scripting attack\nDescription: An input validation issue was addressed with improved\ninput validation. \nCVE-2020-3902: Yi\u011fit Can YILMAZ (@yilmazcanyigit)\n\nWebKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2020-3895: grigoritchy\nCVE-2020-3900: Dongzhuo Zhao working with ADLab of Venustech\n\nWebKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A type confusion issue was addressed with improved\nmemory handling. \nCVE-2020-3901: Benjamin Randazzo (@____benjamin)\n\nWebKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A download\u0027s origin may be incorrectly associated\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-3887: Ryan Pickren (ryanpickren.com)\n\nWebKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: Processing maliciously crafted web content may lead to code\nexecution\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2020-9783: Apple\n\nWebKit\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: A type confusion issue was addressed with improved\nmemory handling. \nCVE-2020-3897: Brendan Draper (@6r3nd4n) working with Trend Micro\u2019s\nZero Day Initiative\n\nWebKit Page Loading\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch 7th generation\nImpact: A file URL may be incorrectly processed\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-3885: Ryan Pickren (ryanpickren.com)\n\nAdditional recognition\n\nFontParser\nWe would like to acknowledge Matthew Denton of Google Chrome for\ntheir assistance. \n\nKernel\nWe would like to acknowledge Siguza for their assistance. \n\nLinkPresentation\nWe would like to acknowledge Travis for their assistance. \n\nNotes\nWe would like to acknowledge Mike DiLoreto for their assistance. \n\nrapportd\nWe would like to acknowledge Alexander Heinrich (@Sn0wfreeze) of\nTechnische Universit\u00e4t Darmstadt for their assistance. \n\nSafari Reader\nWe would like to acknowledge Nikhil Mittal (@c0d3G33k) of Payatu Labs\n(payatu.com) for their assistance. \n\nSidecar\nWe would like to acknowledge Rick Backley (@rback_sec) for their\nassistance. \n\nSiriKit\nWe would like to acknowledge Ioan Florescu and Ki Ha Nam for their\nassistance. \n\nWebKit\nWe would like to acknowledge Emilio Cobos \u00c1lvarez of Mozilla, Samuel\nGro\u00df of Google Project Zero, and an anonymous researcher for their\nassistance. \n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"iOS 13.4 and iPadOS 13.4\". \n\n-----BEGIN PGP SIGNATURE-----\nVersion: BCPG v1.64\n\niQIcBAEDCAAGBQJeekZMAAoJEAc+Lhnt8tDNKCgP/3pVmWn5xSJ/VS0kgOY3XsuF\ndy80y4fIR+0y0Gx2t06RY/5fROnZWYpCs7TjWg0ZoWF73wplM6nfR19QaS0evqrK\nKJq46grrKHnhgrmSqCzNiar5uYm6/S3BLCueikeqAX2osMOI/rmWGy0/BFxgv6vL\nOS6n9n6NO0V9wQQdnOveWMARi0w9M3S07j86T4OUNEw49Z3dNcndP6HYxagQAP1Y\n7O26ls+HkgH7mbHxvUN0WqtmTCaOgB4pXeTCrd4d/ev1LTiO4NH00DcaC6a2adhD\nc7TZO9Ba5H15XVVpkPQqFfiKVfjvQcPrTmKk0mdaLnDOB2ntUnvKplCeZPTFefGw\nZidI9SYUnPWJ4ITxji48PcRhbHALW59PYnhHvRRfxyqYhwsNus9i3UZNXkjm5U0D\nhdDevEztCnkAsqZWq9hvCwDrsIvvlGrueuCC6jqODSNWucod/inOvGZ2N0/rwc/r\nUtlGyZtQj9rWvZix0daOEWYnwSoV09XuIhUlcEEG/CU1XlVOCAD01n02zIGcLc2C\nRm/61L08KcRDRvBLsNEYDgfnvxj2Lsyi2wf8L0VGpkHJkoDifLh64fPYshjhL6t5\nOeKelaH5yPeTdu2bs4ispTmlUJ9NYVHxyDeWGdtz4sfCFAji+pK9uFHFh3woVs6U\nQZLTM48mlSBSN+txWmsZ\n=K2in\n-----END PGP SIGNATURE-----\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-3909"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "db": "VULHUB",
        "id": "VHN-182034"
      },
      {
        "db": "PACKETSTORM",
        "id": "156900"
      },
      {
        "db": "PACKETSTORM",
        "id": "156894"
      },
      {
        "db": "PACKETSTORM",
        "id": "156947"
      },
      {
        "db": "PACKETSTORM",
        "id": "156906"
      },
      {
        "db": "PACKETSTORM",
        "id": "156946"
      },
      {
        "db": "PACKETSTORM",
        "id": "156896"
      },
      {
        "db": "PACKETSTORM",
        "id": "156892"
      }
    ],
    "trust": 2.34
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-3909",
        "trust": 3.2
      },
      {
        "db": "JVN",
        "id": "JVNVU96545608",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1570",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-182034",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "156900",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "156894",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "156947",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "156906",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "156946",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "156896",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "156892",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-182034"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "db": "PACKETSTORM",
        "id": "156900"
      },
      {
        "db": "PACKETSTORM",
        "id": "156894"
      },
      {
        "db": "PACKETSTORM",
        "id": "156947"
      },
      {
        "db": "PACKETSTORM",
        "id": "156906"
      },
      {
        "db": "PACKETSTORM",
        "id": "156946"
      },
      {
        "db": "PACKETSTORM",
        "id": "156896"
      },
      {
        "db": "PACKETSTORM",
        "id": "156892"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-3909"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ]
  },
  "id": "VAR-202004-1982",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-182034"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T11:30:42.947000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "HT211106",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht211106"
      },
      {
        "title": "HT211107",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht211107"
      },
      {
        "title": "HT211100",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht211100"
      },
      {
        "title": "HT211101",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht211101"
      },
      {
        "title": "HT211102",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht211102"
      },
      {
        "title": "HT211103",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht211103"
      },
      {
        "title": "HT211105",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht211105"
      },
      {
        "title": "HT211107",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/ht211107"
      },
      {
        "title": "HT211100",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/ht211100"
      },
      {
        "title": "HT211101",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/ht211101"
      },
      {
        "title": "HT211102",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/ht211102"
      },
      {
        "title": "HT211103",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/ht211103"
      },
      {
        "title": "HT211105",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/ht211105"
      },
      {
        "title": "HT211106",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/ht211106"
      },
      {
        "title": "Multiple Apple product libxml2 Fix for component buffer error vulnerability",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=112982"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-120",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-182034"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-3909"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3909"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/ht211100"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/ht211101"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/ht211102"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/ht211103"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/ht211105"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/ht211106"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/ht211107"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3909"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu96545608/index.html"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3911"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3910"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3901"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3897"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3900"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3895"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/libxml2-buffer-overflow-33104"
      },
      {
        "trust": 0.6,
        "url": "https://support.apple.com/en-us/ht211101"
      },
      {
        "trust": 0.6,
        "url": "https://support.apple.com/en-us/ht211107"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3899"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3902"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3894"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3887"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3885"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3914"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9773"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3883"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3919"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9783"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3913"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9768"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9785"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3917"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3891"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3916"
      },
      {
        "trust": 0.2,
        "url": "https://support.apple.com/ht204283"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/kb/ht204641"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9769"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3903"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3851"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19232"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3905"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3907"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3893"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3884"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3881"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3906"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3912"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8853"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3908"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3892"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9776"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14615"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3904"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/itunes/download/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9780"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/itunes/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3890"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3888"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9770"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9781"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9777"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9775"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-182034"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "db": "PACKETSTORM",
        "id": "156900"
      },
      {
        "db": "PACKETSTORM",
        "id": "156894"
      },
      {
        "db": "PACKETSTORM",
        "id": "156947"
      },
      {
        "db": "PACKETSTORM",
        "id": "156906"
      },
      {
        "db": "PACKETSTORM",
        "id": "156946"
      },
      {
        "db": "PACKETSTORM",
        "id": "156896"
      },
      {
        "db": "PACKETSTORM",
        "id": "156892"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-3909"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-182034"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "db": "PACKETSTORM",
        "id": "156900"
      },
      {
        "db": "PACKETSTORM",
        "id": "156894"
      },
      {
        "db": "PACKETSTORM",
        "id": "156947"
      },
      {
        "db": "PACKETSTORM",
        "id": "156906"
      },
      {
        "db": "PACKETSTORM",
        "id": "156946"
      },
      {
        "db": "PACKETSTORM",
        "id": "156896"
      },
      {
        "db": "PACKETSTORM",
        "id": "156892"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-3909"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-04-01T00:00:00",
        "db": "VULHUB",
        "id": "VHN-182034"
      },
      {
        "date": "2020-04-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "date": "2020-03-25T14:30:03",
        "db": "PACKETSTORM",
        "id": "156900"
      },
      {
        "date": "2020-03-25T14:22:53",
        "db": "PACKETSTORM",
        "id": "156894"
      },
      {
        "date": "2020-03-28T14:19:08",
        "db": "PACKETSTORM",
        "id": "156947"
      },
      {
        "date": "2020-03-25T14:36:33",
        "db": "PACKETSTORM",
        "id": "156906"
      },
      {
        "date": "2020-03-28T14:18:46",
        "db": "PACKETSTORM",
        "id": "156946"
      },
      {
        "date": "2020-03-25T14:25:02",
        "db": "PACKETSTORM",
        "id": "156896"
      },
      {
        "date": "2020-03-25T14:20:32",
        "db": "PACKETSTORM",
        "id": "156892"
      },
      {
        "date": "2020-04-01T18:15:17.053000",
        "db": "NVD",
        "id": "CVE-2020-3909"
      },
      {
        "date": "2020-03-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-06-02T00:00:00",
        "db": "VULHUB",
        "id": "VHN-182034"
      },
      {
        "date": "2020-04-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      },
      {
        "date": "2022-06-02T18:44:25.423000",
        "db": "NVD",
        "id": "CVE-2020-3909"
      },
      {
        "date": "2022-03-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  Apple Product Buffer Overflow Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003577"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1570"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.