⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2020-9859 — Double Free in Apple Macos

CWE-415 — Double FreeCWE-400 — Uncontrolled Resource Consumption5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 73.59%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
7
Apple IOSApple MacosApple Tvos+4 more
Timeline
PublishedJun 5
KEV addedNov 3
KEV dueMay 3
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages9 packages

▶CVEListV5apple/tvosunspecified — tvOS 13.4.6
▶NVDapple/tvos< 13.4.6
▶CVEListV5apple/macosunspecified — macOS Catalina 10.15.5 Supplemental Update
▶NVDapple/ipados< 13.5.1
▶CVEListV5apple/watchosunspecified — watchOS 6.2.6

🔴Vulnerability Details

3
GHSA
GHSA-frwv-8c9x-7766: A memory consumption issue was addressed with improved memory handling↗2022-05-24
▶
CVEList
CVE-2020-9859: A memory consumption issue was addressed with improved memory handling↗2020-06-05
▶
VulnCheck
Apple Multiple Products Code Execution Vulnerability↗2020
▶

📋Vendor Advisories

1
CISA
Apple Multiple Products Code Execution Vulnerability↗2021-11-03
▶
CVE-2020-9859 — Double Free in Apple Macos | cvebase