Lucene search

AppleCVE-2020-3878

HistoryFeb 27, 2020 - 9:15 p.m.

CVE-2020-3878

2020-02-2721:15:18

CWE-125

apple

web.nvd.nist.gov

121

cve-2020-3878

input validation

ios

ipados

macos

tvos

watchos

itunes

icloud

security

vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

53.3%

JSON

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing a maliciously crafted image may lead to arbitrary code execution.

Affected configurations

Nvd

Vulners

Node

appleicloudRange<7.19windows

appleicloudRange11.0–11.2windows

appleitunesRange<12.10.7windows

appleipadosRange<13.5

appleiphone_osRange<13.5

applemac_os_xRange10.13–10.13.6

applemac_os_xRange10.14–10.14.6

applemac_os_xRange10.15–10.15.5

applemac_os_xMatch10.13.6

applemac_os_xMatch10.13.6-

applemac_os_xMatch10.13.6security_update_2018-002

applemac_os_xMatch10.13.6security_update_2018-003

applemac_os_xMatch10.13.6security_update_2019-001

applemac_os_xMatch10.13.6security_update_2019-002

applemac_os_xMatch10.13.6security_update_2019-003

applemac_os_xMatch10.13.6security_update_2019-004

applemac_os_xMatch10.13.6security_update_2019-005

applemac_os_xMatch10.13.6security_update_2019-006

applemac_os_xMatch10.13.6security_update_2019-007

applemac_os_xMatch10.13.6security_update_2020-001

applemac_os_xMatch10.13.6security_update_2020-002

applemac_os_xMatch10.14.6

applemac_os_xMatch10.14.6-

applemac_os_xMatch10.14.6security_update_2019-001

applemac_os_xMatch10.14.6security_update_2019-002

applemac_os_xMatch10.14.6security_update_2019-004

applemac_os_xMatch10.14.6security_update_2019-005

applemac_os_xMatch10.14.6security_update_2019-006

applemac_os_xMatch10.14.6security_update_2019-007

applemac_os_xMatch10.14.6security_update_2020-001

applemac_os_xMatch10.14.6security_update_2020-002

appletvosRange<13.4.5

applewatchosRange<6.2.5

VendorProductVersionCPE
appleicloud*cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
appleitunes*cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
appleipados*cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
applemac_os_x*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:*:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
applemac_os_x10.13.6cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	icloud	*	cpe:2.3:a:apple:icloud::::::windows::*
apple	itunes	*	cpe:2.3:a:apple:itunes::::::windows::*
apple	ipados	*	cpe:2.3:o:apple:ipados::::::::
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	mac_os_x	*	cpe:2.3:o:apple:mac_os_x::::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:::::::*
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:-::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003::::::
apple	mac_os_x	10.13.6	cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001::::::

Rows per page:

1-10 of 301

CNA Affected

[
  {
    "product": "iOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iOS 13.5 and iPadOS 13.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "macOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "macOS Catalina 10.15.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "tvOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "tvOS 13.4.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "watchOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "watchOS 6.2.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "iTunes for Windows",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iTunes 12.10.7 for Windows",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "iCloud for Windows",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iCloud for Windows 11.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "iCloud for Windows (Legacy)",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iCloud for Windows 7.19",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.apple.com/HT211168

support.apple.com/HT211170

support.apple.com/HT211171

support.apple.com/HT211175

support.apple.com/HT211178

support.apple.com/HT211179

support.apple.com/HT211181

Social References

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

53.3%

JSON

Related for CVE-2020-3878