Path traversal

An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A local attacker may be able to elevate their privileges...

Design/Logic Flaw

An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A local user may be able to view sensitive user information...

Design/Logic Flaw

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may...

Integer overflow

An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead t...

Design/Logic Flaw

This issue was addressed with improved entitlements. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A sandboxed process may be able to circumvent sandbox restrictions...

CVE-2020-9994

CVE-2020-9994 is an Apple libxpc path handling vulnerability that could allow a malicious app to overwrite arbitrary files. The issue is addressed by Apple in updates for multiple platforms: iOS 13.5, iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5. Connected documents provide...

CVE-2020-9985

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution...

CVE-2020-9937

CVE-2020-9937 is documented as an out-of-bounds write vulnerability that could allow arbitrary code execution when processing a malicious image. The connected Apple advisories specify affected products and fixed versions: iOS 13.6 and iPadOS 13.6; macOS Catalina 10.15.6; tvOS 13.4.8; watchOS 6.2....

CVE-2020-9937

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may...

CVE-2020-9940

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution...

CVE-2020-9940

CVE-2020-9940 is a buffer overflow issue addressed by Apple in iOS 13.6/iPadOS 13.6, macOS Catalina 10.15.6, and tvOS 13.4.8. Processing a malicious USD file may trigger an application crash or arbitrary code execution. Affected components relate to USD file handling; the root cause is memory han...

CVE-2020-9938

CVE-2020-9938: An out-of-bounds read was addressed with improved input validation. Affects Apple platforms and apps processing images: iOS/iPadOS 13.6, macOS Catalina 10.15.x, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3/7.20. Processing a maliciously crafted im...

CVE-2020-9919

CVE-2020-9919 describes a buffer overflow in image processing surfaces across Apple platforms. The issue affects components such as ImageIO and CoreGraphics (and related image-processing paths) and is triggered by processing maliciously crafted images, potentially allowing arbitrary code executio...

CVE-2020-9919

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead t...

CVE-2020-9920

A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. A malicious mail server may overwrite arbitrary mail files...

CVE-2020-9920

CVE-2020-9920 describes a path handling issue in Apple Mail that could allow a malicious mail server to overwrite arbitrary mail files. The issue is fixed by Apple in iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, and watchOS 6.2.8, addressing improper validation of mail file handling. NVD metada...

CVE-2020-9902

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to determine kernel memory layout...

CVE-2020-9902

CVE-2020-9902 is an out-of-bounds read vulnerability in Apple’s kernel component that could allow a malicious app to determine the kernel memory layout. The issue is fixed in iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, and watchOS 6.2.8. Connected Apple advisories cite kernel memo...

CVE-2020-9904

CVE-2020-9904 is a memory corruption vulnerability in Apple kernel-related components that could allow an attacker to execute arbitrary code with kernel privileges. The issue was mitigated by improved state management and is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, ...

CVE-2020-9904

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An application may be able to execute arbitrary code with kernel privileges...