Lucene search

[email protected]NVD:CVE-2020-9973

HistoryOct 27, 2020 - 9:15 p.m.

CVE-2020-9973

2020-10-2721:15:15

CWE-125

[email protected]

web.nvd.nist.gov

out-of-bounds read

macos

ios

usd file

application termination

arbitrary code execution

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

46.0%

JSON

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave, iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.

Affected configurations

Nvd

Node

appleipadosRange<14.0

appleiphone_osRange<14.0

applemac_os_xRange10.13–10.13.6

applemac_os_xRange10.14–10.14.6

applemac_os_xRange10.15–10.15.7

applemac_os_xMatch10.13.6-

applemac_os_xMatch10.13.6security_update_2018-002

applemac_os_xMatch10.13.6security_update_2018-003

applemac_os_xMatch10.13.6security_update_2019-001

applemac_os_xMatch10.13.6security_update_2019-002

applemac_os_xMatch10.13.6security_update_2019-003

applemac_os_xMatch10.13.6security_update_2019-004

applemac_os_xMatch10.13.6security_update_2019-005

applemac_os_xMatch10.13.6security_update_2019-006

applemac_os_xMatch10.13.6security_update_2019-007

applemac_os_xMatch10.13.6security_update_2020-001

applemac_os_xMatch10.13.6security_update_2020-002

applemac_os_xMatch10.13.6security_update_2020-003

applemac_os_xMatch10.13.6security_update_2020-004

applemac_os_xMatch10.14.6-

applemac_os_xMatch10.14.6security_update_2019-001

applemac_os_xMatch10.14.6security_update_2019-002

applemac_os_xMatch10.14.6security_update_2019-004

applemac_os_xMatch10.14.6security_update_2019-005

applemac_os_xMatch10.14.6security_update_2019-006

applemac_os_xMatch10.14.6security_update_2019-007

applemac_os_xMatch10.14.6security_update_2020-001

applemac_os_xMatch10.14.6security_update_2020-002

applemac_os_xMatch10.14.6security_update_2020-003

applemac_os_xMatch10.14.6security_update_2020-004

VendorProductVersionCPE
appleipados*cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
applemac_os_x*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	ipados	*	cpe:2.3:o:apple:ipados::::::::
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	mac_os_x	*	cpe:2.3:o:apple:mac_os_x::::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:-::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004::::::

Rows per page:

1-10 of 281

References

seclists.org/fulldisclosure/2020/Nov/20

seclists.org/fulldisclosure/2020/Nov/21

support.apple.com/en-us/HT211849

support.apple.com/en-us/HT211850

www.talosintelligence.com/vulnerability_reports/TALOS-2020-1104

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

46.0%

JSON

Related for NVD:CVE-2020-9973

prion1 cve1 talos1 cvelist1 nessus1 openvas1 apple4 threatpost1