CVE-2020-29614

CVE-2020-29614 affects Apple platforms and is described as a heap corruption issue triggered by processing a maliciously crafted file. The description lists affected releases and a fixed status: macOS Big Sur 11.2; Security Update 2021-001 Catalina and Mojave; macOS Big Sur 11.1; Security Update ...

CVE-2020-29610

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 7.2, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. Processing a maliciously crafted audio file may disclose restricted...

CVE-2020-27949

CVE-2020-27949 involves a memory-access vulnerability in macOS DTrace probes via /dev/fasttrap that allowed a non-privileged process to read (and potentially write) memory of other processes traced under DTrace. The PoC exploit demonstrates creating probes in victim processes and replacing memory...

CVE-2020-27952

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. Processing a maliciously crafted font file may lead to arbitrary code execution...

CVE-2020-27947

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. An application may be able to execute arbitrary code with kernel privileges...

CVE-2020-27947

CVE-2020-27947 affects macOS: memory corruption resolved by input validation fixes. Affected in macOS Big Sur 11.1, Security Update 2020-001 Catalina, and Security Update 2020-007 Mojave. Impact: an attacker may be able to execute arbitrary code with kernel privileges via a local vector. Remediat...

CVE-2020-27944

The CVE-2020-27944 entry concerns a memory corruption vulnerability in FontParser when processing maliciously crafted font files. Apple security disclosures (HT212003/HT212005/HT212009) indicate the issue could allow arbitrary code execution and is addressed by updates in watchOS 7.2, macOS Big S...

CVE-2020-27945

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, macOS Big Sur 11.0.1. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2020-27938

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to...

CVE-2020-27938

CVE-2020-27938 is a logic/state-management issue in macOS components that could allow a malicious app to elevate privileges. It is fixed by Apple in macOS Big Sur 11.2 and Security Updates 2020-001 Catalina, 2020-007 Mojave, 2021-001 Catalina, and 2021-001 Mojave, plus macOS Big Sur 11.1. There i...

CVE-2020-27941

CVE-2020-27941 concerns a validation issue in AppleGraphicsControl that could allow an application to execute arbitrary code with kernel privileges. The Apple security content notes the fix in macOS Big Sur 11.1 and Security Updates 2020-001 Catalina / 2020-007 Mojave, indicating these updates ad...

CVE-2020-27939

CVE-2020-27939 affects macOS ImageIO in supported Apple OS releases. A memory corruption issue in processing a maliciously crafted image was addressed by Apple with improved input validation, and is fixed in macOS Big Sur 11.1 as well as Security Update 2020-001 Catalina and Security Update 2020-...

CVE-2020-27937

CVE-2020-27937 is a macOS TCC bypass (Powerdir). Attackers could change a user’s home directory and plant a fake TCC.db to grant arbitrary app permissions (e.g., microphone/camera) without prompts. Exploitation used dscl/dsexport/dsimport or configd, and later fixes (macOS Monterey) patched the u...

CVE-2020-27936

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A local user may be able to cause unexpected system...

CVE-2020-27931

A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, watchOS 7.0,...

CVE-2020-27922

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted font file may lead to...

CVE-2020-27922

CVE-2020-27922 is a logic issue in Apple’s font processing pathway (CoreText/FontParser) that could allow arbitrary code execution when parsing a maliciously crafted font file. The issue is fixed in macOS Big Sur 11.1 and corresponding security updates: Catalina 10.15.7 (Security Update 2020-001)...

CVE-2020-27924

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted image may lea...

CVE-2020-27935

CVE-2020-27935 is a sandbox-related issue addressed by Apple in macOS Big Sur 11.0.1 and in iOS/iPadOS 14.2, watchOS 7.1, tvOS 14.2. The vulnerability is tied to XNU and allows a sandboxed process to circumvent sandbox restrictions. The vulnerability is discussed alongside a family of related iss...

CVE-2020-27920

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing maliciously crafted web content m...