KLA11650 Multiple vulnerabilities in Apple iCloud

Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, perform cross-site scripting attack, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. Multiple memory corruption vulnerabilities in WebKit can be exploited to execute arbitrary code.
2. A buffer overflow vulnerability in libxml2 can be exploited to execute arbitrary code.
3. An out-of-bounds vulnerability in ImageIO can be exploited to execute arbitrary code.
4. Multiple memory corruption vulnerabilities in WebKit Page Loading can be exploited to execute arbitrary code.
5. A logic vulnerability in WebKit can be exploited to perform cross-site scripting attacks.
6. A memory handling vulnerability in WebKit can be exploited to cause a denial of service
7. The HTTP referrer header vulnerability in WebKit can be exploited to obtain sensitive information.
8. A DOM object context vulnerability in WebKit Page Loading can be exploited to bypass security restrictions.

Original advisories

HT210948

HT210947

Related products

Apple-iCloud

CVE list

CVE-2020-3868 critical

CVE-2020-3846 high

CVE-2020-3826 high

CVE-2020-3865 high

CVE-2020-3825 high

CVE-2020-3867 warning

CVE-2020-3862 warning

CVE-2019-8827 warning

CVE-2020-3864 high

Solution

Update to the latest version

Download iCloud

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Apple iCloud earlier than 7.17Apple iCloud earlier than 10.9.2