CVE-2020-27937

CVE-2020-27937 is a macOS TCC bypass (Powerdir). Attackers could change a user’s home directory and plant a fake TCC.db to grant arbitrary app permissions (e.g., microphone/camera) without prompts. Exploitation used dscl/dsexport/dsimport or configd, and later fixes (macOS Monterey) patched the u...

CVE-2020-27936

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A local user may be able to cause unexpected system...

CVE-2020-27931

A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, watchOS 7.0,...

CVE-2020-27922

CVE-2020-27922 is a logic issue in Apple’s font processing pathway (CoreText/FontParser) that could allow arbitrary code execution when parsing a maliciously crafted font file. The issue is fixed in macOS Big Sur 11.1 and corresponding security updates: Catalina 10.15.7 (Security Update 2020-001)...

CVE-2020-27922

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted font file may lead to...

CVE-2020-27924

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted image may lea...

CVE-2020-27935

CVE-2020-27935 is a sandbox-related issue addressed by Apple in macOS Big Sur 11.0.1 and in iOS/iPadOS 14.2, watchOS 7.1, tvOS 14.2. The vulnerability is tied to XNU and allows a sandboxed process to circumvent sandbox restrictions. The vulnerability is discussed alongside a family of related iss...

CVE-2020-27920

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing maliciously crafted web content m...

CVE-2020-27920

CVE-2020-27920 is a use-after-free vulnerability fixed in Apple platforms. The issue, described as a use-after-free leading to code execution when processing maliciously crafted web content, affects macOS Big Sur (11.0.1 and 11.1), Catalina (Security Update 2020-001) and Mojave (Security Update 2...

CVE-2020-27915

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. A malicious application may be able to execute arbitrary code with system privileges...

CVE-2020-27893

An issue existed in screen sharing. This issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. A user with screen sharing access may be able to view another user's screen...

CVE-2020-27893

CVE-2020-27893 affects macOS Big Sur before 11.0.1. The issue is in screen sharing where a user with screen sharing access could view another user’s screen; root cause described as a state-management flaw that was fixed. The publicly stated remediation is to upgrade to macOS Big Sur 11.0.1 (HT211...

CVE-2020-9975

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. An application may be able to execute...

CVE-2020-9978

This issue was addressed with improved setting propagation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. An attacker in a privileged network position may be ab...

CVE-2020-9978

CVE-2020-9978 is an Apple macOS/iOS family issue: a memory/setting-propagation flaw that could allow an attacker in a privileged network position to unexpectedly alter application state. Affected products include macOS Big Sur (11.0.1, 11.1), macOS Catalina (Security Update 2020-001), macOS Mojav...

CVE-2020-10008

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.0.1. A malicious application with root privileges may be able to access private information...

CVE-2020-10008

CVE-2020-10008 is a logic/restrictions issue fixed in macOS Big Sur 11.0.1. The description across Apple and Red Hat sources states that a malicious application with root privileges may access private information, due to a logic issue addressed with improved restrictions and input validation. The...

CVE-2020-9956

CVE-2020-9956 is an out-of-bounds/memory handling issue affecting Apple font parsing components (FontParser/CoreText) where processing a maliciously crafted font file could lead to arbitrary code execution. The vulnerability is addressed in Apple security updates for macOS Big Sur 11.0.1, macOS B...

CVE-2020-9956

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted font file may...

CVE-2020-9971

A logic issue was addressed with improved validation. This issue is fixed in watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14.0, macOS Big Sur 11.0.1. A malicious application may be able to elevate privileges...