CVE-2020-27943
published 2021-04-02CVE-2020-27943: A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in tvOS 14.3…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.98%
58.3th percentile
A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in tvOS 14.3, iOS 14.3 and iPadOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.2. Processing a maliciously crafted font file may lead to arbitrary code execution.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | >= unspecified < 14.3 | 14.3 |
| apple | ipad_os | < 14.3 | 14.3 |
| apple | iphone_os | < 14.3 | 14.3 |
| apple | macos | < 11.1.0 | 11.1.0 |
| apple | macos | >= unspecified < 11.1 | 11.1 |
| apple | tvos | < 14.3 | 14.3 |
| apple | tvos | >= unspecified < 14.3 | 14.3 |
| apple | watchos | < 7.2 | 7.2 |
| apple | watchos | >= unspecified < 7.2 | 7.2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h5f4-vjcr-r562: A memory corruption issue existed in the processing of font files
ghsa_unreviewed·2022-05-24
CVE-2020-27943 [HIGH] CWE-119 GHSA-h5f4-vjcr-r562: A memory corruption issue existed in the processing of font files
A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in tvOS 14.3, iOS 14.3 and iPadOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.2. Processing a maliciously crafted font file may lead to arbitrary code execution.
Project0
Project Zero RCA: CVE-2020-27930: Safari RCE in Type 1 fonts handled by libType1Scaler.dylib
project_zero·CVSS 7.8
CVE-2020-27930 [HIGH] Project Zero RCA: CVE-2020-27930: Safari RCE in Type 1 fonts handled by libType1Scaler.dylib
# CVE-2020-27930: Safari RCE in Type 1 fonts handled by libType1Scaler.dylib
*Mateusz Jurczyk and Sergei Glazunov, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2021-02-04)*
## The Basics
**Disclosure or Patch Date:** 5 November 2020
**Product:** Apple Safari
**Advisory:** https://support.apple.com/en-us/HT211929
**Affected Versions:** iOS 14.1 and previous, macOS 10.15.6 and previous
**First Patched Version:** iOS 14.2 and macOS 10.15.7
**Issue/Bug Report:** https://bugs.chromium.org/p/project-zero/issues/detail?id=2105
**Patch CL:** N/A
**Bug-Introducing CL:** N/A
**Reporter(s):** Mateusz Jurczyk & Sergei Glazunov of Google Project Zero
## The Code
**Proof-of-concept:** https://bugs.chromium.org/p/project-zero/issues
No detection rules found.
No public exploits indexed.
https://support.apple.com/en-us/HT212003https://support.apple.com/en-us/HT212005https://support.apple.com/en-us/HT212009https://support.apple.com/en-us/HT212011https://support.apple.com/en-us/HT212003https://support.apple.com/en-us/HT212005https://support.apple.com/en-us/HT212009https://support.apple.com/en-us/HT212011
2021-04-02
Published