ID

VAR-202012-0762


CVE

CVE-2020-27917


TITLE

plural  Apple  Product Free Memory Usage Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-014240

DESCRIPTION

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to code execution. This vulnerability number has been assigned, and the vulnerability details will be updated soon. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-11-05-1 iOS 14.2 and iPadOS 14.2 iOS 14.2 and iPadOS 14.2 are now available and address the following issues. Information about the security content is also available at https://support.apple.com/HT211929. Audio Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-27910: JunDong Xie and XingWei Lin of Ant Security Light- Year Lab Audio Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds write was addressed with improved input validation. CVE-2020-27916: JunDong Xie of Ant Security Light-Year Lab CallKit Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A user may answer two calls simultaneously without indication they have answered a second call Description: An issue existed in the handling of incoming calls. CVE-2020-27925: Nick Tangri CoreAudio Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds write was addressed with improved input validation. CVE-2020-10017: Francis working with Trend Micro Zero Day Initiative, JunDong Xie of Ant Security Light-Year Lab CoreAudio Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-27909: Anonymous working with Trend Micro Zero Day Initiative, JunDong Xie and XingWei Lin of Ant Security Light-Year Lab Crash Reporter Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A local attacker may be able to elevate their privileges Description: An issue existed within the path validation logic for symlinks. CVE-2020-10003: Tim Michaud (@TimGMichaud) of Leviathan FontParser Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted font may lead to arbitrary code execution. Apple is aware of reports that an exploit for this issue exists in the wild. CVE-2020-27930: Google Project Zero FontParser Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-27927: Xingwei Lin of Ant Security Light-Year Lab Foundation Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A local user may be able to read arbitrary files Description: A logic issue was addressed with improved state management. CVE-2020-10002: James Hutchins ImageIO Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write was addressed with improved input validation. CVE-2020-27912: Xingwei Lin of Ant Security Light-Year Lab IOAcceleratorFamily Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved state management. CVE-2020-27905: Mohamed Ghannam (@_simo36) Kernel Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A malicious application may be able to disclose kernel memory. Apple is aware of reports that an exploit for this issue exists in the wild. CVE-2020-27950: Google Project Zero Kernel Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A malicious application may be able to determine kernel memory layout Description: A logic issue was addressed with improved state management. CVE-2020-9974: Tommy Muir (@Muirey03) Kernel Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2020-10016: Alex Helie Kernel Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild. CVE-2020-27932: Google Project Zero Keyboard Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A person with physical access to an iOS device may be able to access stored passwords without authentication Description: An authentication issue was addressed with improved state management. CVE-2020-27902: Connor Ford (@connorford2) libxml2 Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing maliciously crafted web content may lead to code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-27917: found by OSS-Fuzz libxml2 Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An integer overflow was addressed through improved input validation. CVE-2020-27911: found by OSS-Fuzz libxml2 Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-27926: found by OSS-Fuzz Logging Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: A local attacker may be able to elevate their privileges Description: A path handling issue was addressed with improved validation. CVE-2020-10010: Tommy Muir (@Muirey03) Model I/O Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: A logic issue was addressed with improved state management. CVE-2020-10004: Aleksandar Nikolic of Cisco Talos Model I/O Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-13524: Aleksandar Nikolic of Cisco Talos Model I/O Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-10011: Aleksandar Nikolic of Cisco Talos WebKit Available for: iPhone 6s and later, iPod touch 7th generation, iPad Air 2 and later, and iPad mini 4 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-27918: an anonymous researcher Safari We would like to acknowledge Gabriel Corona for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 14.2 and iPadOS 14.2". This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAl+khmUACgkQZcsbuWJ6 jjA/cxAArQHJ0PJZVPQ5gF3071ZxAlwu7iHuphiiYzM9JYskEJYymSxaRxm3mPaK sT+1znbSDecwZLwFM5Luepkk3DHuj2sFRMZvYDfVvxvCvCob2b5ZQTsjfAimxemz nrGFcZp/fRGSu1vG1l/wZRta3J6n1WogIvYw+belthcnJHjJ+KThmXL/iDOTRXev KgS2K94G6tRAkgIUPuuLFnnrxHNyplzhECJXe55YBnkZxGcOBg0ZF7itF8F4q9sQ TtnfgGxgKbkxXXGKID/ihgByEOI1iSSiiCMsKm2OoltaCB1kcOuT0PwuygRBZaDA j+HdamnxBErgsQeTvaJPRlIEJFJgVrmr8/nHfKqxNSpF2LxDK+NTXQqo4iAHjy0j QN4vmKueIN2j6IQmey3zwlkpao8Wg0mYNt9auWHC/S3aNCFVCEKLwUC9e74Ckbzk 5kWpUgtQsUdZDkHZRfPhEntB69KFGfaBAv+fZNewtnsVtoiqx8uxSDCsS8FY6qZL X/wb2BKgqqmKfketffhihTKGKbBd045tyfjPd1Bodp753U6SKnhPMIQ283uHglEc auWTj5YBeFtszLYaDvNi4DMci5olBd6n61kuSt8W+hy9vGPIREfPihsZFSGOwB53 ItcJGAqRgwlUEy4O3HUVugUXIJ3qhoHhV+SPaKcWomW3pJgzpg8= =9YuD -----END PGP SIGNATURE-----

Trust: 1.89

sources: NVD: CVE-2020-27917 // JVNDB: JVNDB-2020-014240 // VULHUB: VHN-372028 // PACKETSTORM: 159969 // PACKETSTORM: 159953

AFFECTED PRODUCTS

vendor:applemodel:macosscope:ltversion:11.0.1

Trust: 1.0

vendor:applemodel:icloudscope:ltversion:11.5

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:7.1

Trust: 1.0

vendor:applemodel:itunesscope:ltversion:12.11

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:14.2

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:14.2

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:14.2

Trust: 1.0

vendor:アップルmodel:apple mac os xscope: - version: -

Trust: 0.8

vendor:アップルmodel:tvosscope: - version: -

Trust: 0.8

vendor:アップルmodel:watchosscope:eqversion:7.1

Trust: 0.8

vendor:アップルmodel:itunesscope: - version: -

Trust: 0.8

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

vendor:アップルmodel:icloudscope: - version: -

Trust: 0.8

vendor:アップルmodel:watchosscope:ltversion:(apple watch series 3 or later )

Trust: 0.8

vendor:アップルmodel:ipadosscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-014240 // NVD: CVE-2020-27917

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-27917
value: HIGH

Trust: 1.0

NVD: CVE-2020-27917
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202011-586
value: HIGH

Trust: 0.6

VULHUB: VHN-372028
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-27917
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-372028
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-27917
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-27917
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-372028 // JVNDB: JVNDB-2020-014240 // CNNVD: CNNVD-202011-586 // NVD: CVE-2020-27917

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

problemtype:Use of freed memory (CWE-416) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-372028 // JVNDB: JVNDB-2020-014240 // NVD: CVE-2020-27917

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202011-586

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202011-586

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-372028

PATCH

title:HT211933 Apple  Security updateurl:https://support.apple.com/en-us/HT211928

Trust: 0.8

title:Apple iCloud for Windows Remediation of resource management error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=137109

Trust: 0.6

sources: JVNDB: JVNDB-2020-014240 // CNNVD: CNNVD-202011-586

EXTERNAL IDS

db:NVDid:CVE-2020-27917

Trust: 2.7

db:PACKETSTORMid:159953

Trust: 0.8

db:JVNid:JVNVU99462952

Trust: 0.8

db:JVNid:JVNVU92370378

Trust: 0.8

db:JVNDBid:JVNDB-2020-014240

Trust: 0.8

db:CNNVDid:CNNVD-202011-586

Trust: 0.7

db:AUSCERTid:ESB-2020.4060

Trust: 0.6

db:AUSCERTid:ESB-2020.3911

Trust: 0.6

db:AUSCERTid:ESB-2020.4060.2

Trust: 0.6

db:PACKETSTORMid:159969

Trust: 0.2

db:VULHUBid:VHN-372028

Trust: 0.1

sources: VULHUB: VHN-372028 // JVNDB: JVNDB-2020-014240 // PACKETSTORM: 159969 // PACKETSTORM: 159953 // CNNVD: CNNVD-202011-586 // NVD: CVE-2020-27917

REFERENCES

url:https://support.apple.com/en-us/ht211929

Trust: 2.3

url:https://support.apple.com/en-us/ht211933

Trust: 2.3

url:https://support.apple.com/en-us/ht211935

Trust: 2.3

url:http://seclists.org/fulldisclosure/2020/dec/32

Trust: 1.7

url:https://support.apple.com/en-us/ht211928

Trust: 1.7

url:https://support.apple.com/en-us/ht211930

Trust: 1.7

url:https://support.apple.com/en-us/ht211931

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-27917

Trust: 1.6

url:https://jvn.jp/vu/jvnvu99462952/

Trust: 0.8

url:https://jvn.jp/vu/jvnvu92370378/

Trust: 0.8

url:https://www.auscert.org.au/bulletins/esb-2020.3911/

Trust: 0.6

url:https://support.apple.com/kb/ht211928

Trust: 0.6

url:https://packetstormsecurity.com/files/159953/apple-security-advisory-2020-11-05-1.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/apple-ios-14-multiple-vulnerabilities-33841

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.4060/

Trust: 0.6

url:https://support.apple.com/kb/ht211933

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.4060.2/

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-10002

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10017

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27916

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27918

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27909

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27912

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10010

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10003

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27911

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27927

Trust: 0.2

url:https://www.apple.com/support/security/pgp/

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10016

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27905

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27910

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-9974

Trust: 0.2

url:https://support.apple.com/kb/ht201222

Trust: 0.1

url:https://support.apple.com/ht211930.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-13524

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-27926

Trust: 0.1

url:https://www.apple.com/itunes/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-27925

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-27902

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10011

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-27930

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-27932

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10004

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-27950

Trust: 0.1

url:https://support.apple.com/ht211929.

Trust: 0.1

sources: VULHUB: VHN-372028 // JVNDB: JVNDB-2020-014240 // PACKETSTORM: 159969 // PACKETSTORM: 159953 // CNNVD: CNNVD-202011-586 // NVD: CVE-2020-27917

CREDITS

Apple

Trust: 0.8

sources: PACKETSTORM: 159969 // PACKETSTORM: 159953 // CNNVD: CNNVD-202011-586

SOURCES

db:VULHUBid:VHN-372028
db:JVNDBid:JVNDB-2020-014240
db:PACKETSTORMid:159969
db:PACKETSTORMid:159953
db:CNNVDid:CNNVD-202011-586
db:NVDid:CVE-2020-27917

LAST UPDATE DATE

2024-08-14T13:16:25.300000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-372028date:2021-03-10T00:00:00
db:JVNDBid:JVNDB-2020-014240date:2021-08-12T07:57:00
db:CNNVDid:CNNVD-202011-586date:2021-11-03T00:00:00
db:NVDid:CVE-2020-27917date:2021-03-10T14:54:16.040

SOURCES RELEASE DATE

db:VULHUBid:VHN-372028date:2020-12-08T00:00:00
db:JVNDBid:JVNDB-2020-014240date:2021-08-12T00:00:00
db:PACKETSTORMid:159969date:2020-11-09T18:59:25
db:PACKETSTORMid:159953date:2020-11-09T18:10:20
db:CNNVDid:CNNVD-202011-586date:2020-11-05T00:00:00
db:NVDid:CVE-2020-27917date:2020-12-08T21:15:13.530