CVE-2020-27908
published 2021-04-02CVE-2020-27908: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.12%
62.5th percentile
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted audio file may lead to arbitrary code execution.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_14.2_and_ipados | — | — |
| apple | ios_and_ipados | >= unspecified < 14.2 | 14.2 |
| apple | ipados | < 14.2 | 14.2 |
| apple | iphone_os | < 14.2 | 14.2 |
| apple | mac_os_x | < 11.0.1 | 11.0.1 |
| apple | mac_os_x | < 11.1.0 | 11.1.0 |
| apple | macos | >= unspecified < 11.0 | 11.0 |
| apple | macos | >= unspecified < 11.1 | 11.1 |
| apple | tvos | < 14.2 | 14.2 |
| apple | tvos | >= unspecified < 14.2 | 14.2 |
| apple | watchos | < 7.1 | 7.1 |
| apple | watchos | >= unspecified < 7.1 | 7.1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2020-27908: iOS 14.2 and iPadOS 14.2
vendor_apple·2020-11-05·CVSS 7.8
CVE-2020-27908 [HIGH] CVE-2020-27908: iOS 14.2 and iPadOS 14.2
Apple Security Update: About the security content of iOS 14.2 and iPadOS 14.2
Product: iOS 14.2 and iPadOS
Version: 14.2
CVE: CVE-2020-27908
Component: CoreAudio
Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
GHSA
GHSA-4m83-j6wp-jrp5: An out-of-bounds read was addressed with improved input validation
ghsa_unreviewed·2022-05-24
CVE-2020-27908 [HIGH] CWE-125 GHSA-4m83-j6wp-jrp5: An out-of-bounds read was addressed with improved input validation
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted audio file may lead to arbitrary code execution.
No detection rules found.
No public exploits indexed.
Qualys
Prevent Pegasus Spyware Attacks with VMDR | Qualys
blogs_qualys·2021-07-23
Prevent Pegasus Spyware Attacks with VMDR | Qualys
#### Table of Contents
- Attack Vectors and Impact of Pegasus Spyware
- VMDR for Mobile Devices Helps Protect from Pegasus Spyware
- Get Started Now
Pegasus spyware is in the news, and it has been used to target devices of critical people from different sectors and countries including journalists, activists, politicians, and business executives. It has been said that a leaked list of 50,000 phone numbers of potential surveillance targets was obtained by Paris-based journalism nonprofit Forbidden Stories and Amnesty International.
Pegasus spyware is a surveillance software created by Israeli cyber intelligence firm NSO Group. Pegasus is one such software developed to gain access to your phone without consent and gather personal and sensitive information and deliver it to the user spying
Qualys
Protect your Devices from Pegasus Spyware using VMDR for Mobile Devices’ Proactive Approach
blogs_qualys·2021-07-23
Protect your Devices from Pegasus Spyware using VMDR for Mobile Devices’ Proactive Approach
## Table of Contents
Attack Vectors and Impact of Pegasus Spyware
VMDR for Mobile Devices Helps Protect from Pegasus Spyware
Get Started Now
Pegasus spyware is in the news, and it has been used to target devices of critical people from different sectors and countries including journalists, activists, politicians, and business executives. It has been said that a leaked list of 50,000 phone numbers of potential surveillance targets was obtained by Paris-based journalism nonprofit Forbidden Stories and Amnesty International.
Pegasus spyware is a surveillance software created by Israeli cyber intelligence firm NSO Group. Pegasus is one such software developed to gain access to your phone without consent and gather personal and sensitive information and deliver it to the user spying on you
https://support.apple.com/en-us/HT211928https://support.apple.com/en-us/HT211929https://support.apple.com/en-us/HT211930https://support.apple.com/en-us/HT211931https://support.apple.com/en-us/HT212011https://support.apple.com/en-us/HT211928https://support.apple.com/en-us/HT211929https://support.apple.com/en-us/HT211930https://support.apple.com/en-us/HT211931https://support.apple.com/en-us/HT212011
2021-04-02
Published