7.8

CVE-2020-27930

Warnung
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ iPadOS Version < 14.2
Apple ≫ iPhone OS Version < 12.4.9
Apple ≫ iPhone OS Version >= 14.0 < 14.2
Apple ≫ macOS X Version < 10.15.7
Apple ≫ macOS Version >= 11.0 < 11.0.1
Apple ≫ watchOS Version < 5.3.9
Apple ≫ watchOS Version >= 6.0 < 6.2.9
Apple ≫ watchOS Version >= 7.0 < 7.1

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Apple Multiple Products Memory Corruption Vulnerability

Schwachstelle

Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 22.01% 0.975
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://seclists.org/fulldisclosure/2020/Dec/32
Third Party Advisory
Mailing List
https://support.apple.com/en-us/HT211928
Vendor Advisory
https://support.apple.com/en-us/HT211929
Vendor Advisory
https://support.apple.com/en-us/HT211931
Vendor Advisory
https://support.apple.com/en-us/HT211940
Vendor Advisory
http://packetstormsecurity.com/files/161294/Apple-Safari-Remote-Code-Execution.html
Third Party Advisory
VDB Entry
https://support.apple.com/en-us/HT211944
Vendor Advisory
https://support.apple.com/en-us/HT211945
Vendor Advisory
https://support.apple.com/en-us/HT211946
Vendor Advisory
https://support.apple.com/en-us/HT211947
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27930
US Government Resource