KLA11705 Multiple vulnerabilities in Apple iCloud

Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, perform cross-site scripting attack, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A logic vulnerability in WebKit can be exploited to bypass security restrictions.
2. Buffer overflow vulnerability in libxml2 can be exploited to cause denial of service.
3. Memory corruption vulnerability in WebKit can be exploited via a specially crafted webpage to execute arbitrary code.
4. A type confusion vulnerability in WebKit can be exploited via a specially crafted webpage to execute arbitrary code.
5. An input validation vulnerability in WebKit can be exploited via specially crafted webpage to perform cross-site scripting attacks.
6. A race condition vulnerability in WebKit can be exploited to obtain sensitive information.
7. A type confusion vulnerability in WebKit can be exploited remotely to execute arbitrary code.
8. Use after free vulnerability in WebKit can be exploited via a specially crafted webpage to execute arbitrary code.
9. A memory consumption vulnerability in WebKit can be exploited remotely to execute arbitrary code.
10. A logic vulnerability in WebKit Loading Page can be exploited to bypass security restrictions.

Original advisories

About the security content of iCloud for Windows 7.18

About the security content of iCloud for Windows 10.9.3

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apple-iCloud

CVE list

CVE-2020-9783 high

CVE-2020-3909 critical

CVE-2020-3910 critical

CVE-2020-3887 warning

CVE-2020-3895 critical

CVE-2020-3894 warning

CVE-2020-3901 high

CVE-2020-3899 critical

CVE-2020-3900 high

CVE-2020-3897 critical

CVE-2020-3902 warning

CVE-2020-3885 warning

CVE-2020-3911 critical

Solution

Update to the latest version

Download iCloud

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

• Apple iCloud earlier than 7.18Apple iCloud earlier than 10.9.3