7.8

CVE-2020-9859

Warning

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.

Data is provided by the National Vulnerability Database (NVD)
Apple ≫ iPadOS Version < 13.5.1
Apple ≫ iPhone OS Version < 13.5.1
Apple ≫ macOS X Version < 10.15.5
Apple ≫ tvOS Version < 13.4.6
Apple ≫ watchOS Version < 6.2.6

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Apple Multiple Products Code Execution Vulnerability

Vulnerability

Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.21% 0.428
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

https://support.apple.com/HT211214
Vendor Advisory
Release Notes