Details of VAR-202104-0450

ID

VAR-202104-0450

CVE

CVE-2020-9926

TITLE

plural Apple Product Use of Freed Memory Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-017309

DESCRIPTION

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, iCloud for Windows 7.20, macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution. plural Apple The product contains a usage of freed memory vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Both Apple iOS and Apple tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system

Trust: 1.8

sources: NVD: CVE-2020-9926 // JVNDB: JVNDB-2020-017309 // VULHUB: VHN-188051 // VULMON: CVE-2020-9926

AFFECTED PRODUCTS

vendor:	apple	model:	icloud	scope:	lt	version:	7.20	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	eq	version:	10.13.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lt	version:	10.15.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lt	version:	10.13.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	eq	version:	10.14.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lt	version:	10.14.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	gte	version:	10.14	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	gte	version:	10.15	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	lt	version:	13.6	Trust: 1.0
vendor:	apple	model:	tvos	scope:	lt	version:	13.4.8	Trust: 1.0
vendor:	apple	model:	watchos	scope:	lt	version:	6.2.8	Trust: 1.0
vendor:	apple	model:	ipados	scope:	lt	version:	13.6	Trust: 1.0
vendor:	アップル	model:	tvos	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	icloud	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	apple mac os x	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	watchos	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	ipados	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	ios	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-017309 // NVD: CVE-2020-9926

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-9926
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-9926
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202104-087
value:	HIGH
Trust: 0.6
VULHUB:	VHN-188051
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2020-9926
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-9926
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-188051
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-9926
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2020-9926
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-188051 // VULMON: CVE-2020-9926 // JVNDB: JVNDB-2020-017309 // CNNVD: CNNVD-202104-087 // NVD: CVE-2020-9926

PROBLEMTYPE DATA

problemtype:	CWE-416	Trust: 1.1
problemtype:	Use of freed memory (CWE-416) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-188051 // JVNDB: JVNDB-2020-017309 // NVD: CVE-2020-9926

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202104-087

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202104-087

PATCH

title:	HT211291 Apple Security update	url:	https://support.apple.com/en-us/HT211288	Trust: 0.8
title:	Apple Repair measures for resource management errors and vulnerabilities in multiple products	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=146629	Trust: 0.6

sources: JVNDB: JVNDB-2020-017309 // CNNVD: CNNVD-202104-087

EXTERNAL IDS

db:	NVD	id:	CVE-2020-9926	Trust: 3.4
db:	JVN	id:	JVNVU94090210	Trust: 0.8
db:	JVN	id:	JVNVU95491800	Trust: 0.8
db:	JVNDB	id:	JVNDB-2020-017309	Trust: 0.8
db:	CNNVD	id:	CNNVD-202104-087	Trust: 0.6
db:	VULHUB	id:	VHN-188051	Trust: 0.1
db:	VULMON	id:	CVE-2020-9926	Trust: 0.1

sources: VULHUB: VHN-188051 // VULMON: CVE-2020-9926 // JVNDB: JVNDB-2020-017309 // CNNVD: CNNVD-202104-087 // NVD: CVE-2020-9926

REFERENCES

url:	https://support.apple.com/en-us/ht211288	Trust: 1.8
url:	https://support.apple.com/en-us/ht211289	Trust: 1.8
url:	https://support.apple.com/en-us/ht211290	Trust: 1.8
url:	https://support.apple.com/en-us/ht211291	Trust: 1.8
url:	https://support.apple.com/en-us/ht211295	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2020-9926	Trust: 1.4
url:	https://jvn.jp/vu/jvnvu94090210/	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu95491800/	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/416.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-188051 // VULMON: CVE-2020-9926 // JVNDB: JVNDB-2020-017309 // CNNVD: CNNVD-202104-087 // NVD: CVE-2020-9926

SOURCES

db:	VULHUB	id:	VHN-188051
db:	VULMON	id:	CVE-2020-9926
db:	JVNDB	id:	JVNDB-2020-017309
db:	CNNVD	id:	CNNVD-202104-087
db:	NVD	id:	CVE-2020-9926

LAST UPDATE DATE

2024-08-14T12:40:19.547000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-188051	date:	2021-04-08T00:00:00
db:	VULMON	id:	CVE-2020-9926	date:	2021-04-08T00:00:00
db:	JVNDB	id:	JVNDB-2020-017309	date:	2022-09-07T06:50:00
db:	CNNVD	id:	CNNVD-202104-087	date:	2021-04-09T00:00:00
db:	NVD	id:	CVE-2020-9926	date:	2021-04-08T17:41:33.290

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-188051	date:	2021-04-02T00:00:00
db:	VULMON	id:	CVE-2020-9926	date:	2021-04-02T00:00:00
db:	JVNDB	id:	JVNDB-2020-017309	date:	2022-09-07T00:00:00
db:	CNNVD	id:	CNNVD-202104-087	date:	2021-04-02T00:00:00
db:	NVD	id:	CVE-2020-9926	date:	2021-04-02T18:15:18.217