CVE-2020-9919 — HIGH (7.8) — White Hats Nepal

Q: How severe is CVE-2020-9919?

CVE-2020-9919 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2020-9919?

Check the references section above for vendor advisories and patch information. Affected products include: Apple Icloud, Apple Itunes, Apple Ipados, Apple Iphone Os, Apple Mac Os X.

Vulnerability Description

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Apple	Icloud	< 7.20
Apple	Itunes	< 12.10.8
Apple	Ipados	< 13.6
Apple	Iphone Os	< 13.6
Apple	Mac Os X	< 10.15.6
Apple	Tvos	< 13.4.8
Apple	Watchos	< 6.2.8

Related Weaknesses (CWE)

CWE-787

References

https://support.apple.com/kb/HT211288Vendor Advisory
https://support.apple.com/kb/HT211289Vendor Advisory
https://support.apple.com/kb/HT211290Vendor Advisory
https://support.apple.com/kb/HT211291Vendor Advisory
https://support.apple.com/kb/HT211293Vendor Advisory
https://support.apple.com/kb/HT211294Vendor Advisory
https://support.apple.com/kb/HT211295Vendor Advisory
https://support.apple.com/kb/HT211288Vendor Advisory
https://support.apple.com/kb/HT211289Vendor Advisory
https://support.apple.com/kb/HT211290Vendor Advisory
https://support.apple.com/kb/HT211291Vendor Advisory
https://support.apple.com/kb/HT211293Vendor Advisory
https://support.apple.com/kb/HT211294Vendor Advisory
https://support.apple.com/kb/HT211295Vendor Advisory

FAQ

What is CVE-2020-9919?

CVE-2020-9919 is a vulnerability with a CVSS score of 7.8 (HIGH). A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iC...

How severe is CVE-2020-9919?

CVE-2020-9919 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-9919?

Check the references section above for vendor advisories and patch information. Affected products include: Apple Icloud, Apple Itunes, Apple Ipados, Apple Iphone Os, Apple Mac Os X.