CVE-2020-9883

high-risk

Published 2020-10-22

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.

Do I need to act?

1.1% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (20)

Icloud

Itunes

Ipados

Iphone Os

Mac Os X

Affected Vendors

Apple

References (20)

Mailing List http://seclists.org/fulldisclosure/2020/Dec/32

Vendor Advisory https://support.apple.com/kb/HT211288

Vendor Advisory https://support.apple.com/kb/HT211289

Vendor Advisory https://support.apple.com/kb/HT211290

Vendor Advisory https://support.apple.com/kb/HT211291

Vendor Advisory https://support.apple.com/kb/HT211293

Vendor Advisory https://support.apple.com/kb/HT211294

Vendor Advisory https://support.apple.com/kb/HT211295

Vendor Advisory https://support.apple.com/kb/HT211931

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-1389/