Sign-up

ID

VAR-202104-0173


CVE

CVE-2020-27931


TITLE

plural  Apple  Out-of-bounds write vulnerabilities in the product

Trust: 0.8

sources: JVNDB: JVNDB-2020-017276

DESCRIPTION

A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0. Processing a maliciously crafted font file may lead to arbitrary code execution. plural Apple The product contains a vulnerability related to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the libFontParser library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.The specific flaw exists within the parsing of TTF fonts. Crafted data in a TTF font can trigger a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Apple macOS is a set of dedicated operating systems developed by Apple Corporation for Mac computers. A buffer error vulnerability exists in Apple macOs. The vulnerability stems from some unknown functionality of the component FontParser. Entering unknown operations will result in memory corruption

Trust: 2.43

sources: NVD: CVE-2020-27931 // JVNDB: JVNDB-2020-017276 // ZDI: ZDI-20-1405 // VULHUB: VHN-372042 // VULMON: CVE-2020-27931

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:ltversion:14.0

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:14.0

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:7.0

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:14.0

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:11.1.0

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:11.0.1

Trust: 1.0

vendor:アップルmodel:apple mac os xscope: - version: -

Trust: 0.8

vendor:アップルmodel:ipadosscope: - version: -

Trust: 0.8

vendor:アップルmodel:tvosscope: - version: -

Trust: 0.8

vendor:アップルmodel:watchosscope: - version: -

Trust: 0.8

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

vendor:applemodel:macosscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-20-1405 // JVNDB: JVNDB-2020-017276 // NVD: CVE-2020-27931

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-27931
value: HIGH

Trust: 1.0

NVD: CVE-2020-27931
value: HIGH

Trust: 0.8

ZDI: CVE-2020-27931
value: LOW

Trust: 0.7

CNNVD: CNNVD-202012-1103
value: HIGH

Trust: 0.6

VULHUB: VHN-372042
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-27931
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-27931
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-372042
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-27931
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-27931
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2020-27931
baseSeverity: LOW
baseScore: 3.3
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 1.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-20-1405 // VULHUB: VHN-372042 // VULMON: CVE-2020-27931 // JVNDB: JVNDB-2020-017276 // CNNVD: CNNVD-202012-1103 // NVD: CVE-2020-27931

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

problemtype:CWE-119

Trust: 0.1

sources: VULHUB: VHN-372042 // JVNDB: JVNDB-2020-017276 // NVD: CVE-2020-27931

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202012-1103

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202012-1103

PATCH

title:HT211931 Apple  Security updateurl:https://support.apple.com/en-us/HT211843

Trust: 0.8

title:Apple macOs Buffer error repair measuresurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=137043

Trust: 0.6

title:Apple: macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojaveurl:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=60a51a6d3f600c46241622f208f75bff

Trust: 0.1

sources: VULMON: CVE-2020-27931 // JVNDB: JVNDB-2020-017276 // CNNVD: CNNVD-202012-1103

EXTERNAL IDS

db:NVDid:CVE-2020-27931

Trust: 4.1

db:JVNid:JVNVU99462952

Trust: 0.8

db:JVNid:JVNVU95288122

Trust: 0.8

db:JVNid:JVNVU92546061

Trust: 0.8

db:JVNDBid:JVNDB-2020-017276

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-11801

Trust: 0.7

db:ZDIid:ZDI-20-1405

Trust: 0.7

db:AUSCERTid:ESB-2020.4060.2

Trust: 0.6

db:CNNVDid:CNNVD-202012-1103

Trust: 0.6

db:VULHUBid:VHN-372042

Trust: 0.1

db:VULMONid:CVE-2020-27931

Trust: 0.1

sources: ZDI: ZDI-20-1405 // VULHUB: VHN-372042 // VULMON: CVE-2020-27931 // JVNDB: JVNDB-2020-017276 // CNNVD: CNNVD-202012-1103 // NVD: CVE-2020-27931

REFERENCES

url:https://support.apple.com/en-us/ht211843

Trust: 1.8

url:https://support.apple.com/en-us/ht211844

Trust: 1.8

url:https://support.apple.com/en-us/ht211850

Trust: 1.8

url:https://support.apple.com/en-us/ht211931

Trust: 1.8

url:https://support.apple.com/en-us/ht212011

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-27931

Trust: 1.4

url:http://jvn.jp/vu/jvnvu92546061/index.html

Trust: 0.8

url:http://jvn.jp/vu/jvnvu99462952/index.html

Trust: 0.8

url:http://jvn.jp/vu/jvnvu95288122/index.html

Trust: 0.8

url:https://www.auscert.org.au/bulletins/esb-2020.4060.2/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/119.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://support.apple.com/kb/ht212011

Trust: 0.1

sources: VULHUB: VHN-372042 // VULMON: CVE-2020-27931 // JVNDB: JVNDB-2020-017276 // CNNVD: CNNVD-202012-1103 // NVD: CVE-2020-27931

CREDITS

Mickey Jin & Junzhi Lu of Trend Micro Mobile Security Research Team

Trust: 0.7

sources: ZDI: ZDI-20-1405

SOURCES

db:ZDIid:ZDI-20-1405
db:VULHUBid:VHN-372042
db:VULMONid:CVE-2020-27931
db:JVNDBid:JVNDB-2020-017276
db:CNNVDid:CNNVD-202012-1103
db:NVDid:CVE-2020-27931

LAST UPDATE DATE

2024-08-14T12:41:27.378000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-20-1405date:2020-12-08T00:00:00
db:VULHUBid:VHN-372042date:2023-01-09T00:00:00
db:VULMONid:CVE-2020-27931date:2021-04-06T00:00:00
db:JVNDBid:JVNDB-2020-017276date:2022-08-29T01:30:00
db:CNNVDid:CNNVD-202012-1103date:2023-01-10T00:00:00
db:NVDid:CVE-2020-27931date:2023-01-09T16:41:59.350

SOURCES RELEASE DATE

db:ZDIid:ZDI-20-1405date:2020-12-08T00:00:00
db:VULHUBid:VHN-372042date:2021-04-02T00:00:00
db:VULMONid:CVE-2020-27931date:2021-04-02T00:00:00
db:JVNDBid:JVNDB-2020-017276date:2022-08-29T00:00:00
db:CNNVDid:CNNVD-202012-1103date:2020-12-15T00:00:00
db:NVDid:CVE-2020-27931date:2021-04-02T18:15:15.983