CVE-2020-9926
published 2021-04-02CVE-2020-9926: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, iCloud for…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.01%
59.3th percentile
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, iCloud for Windows 7.20, macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | icloud | < 7.20 | 7.20 |
| apple | ios_13.6_and_ipados | — | — |
| apple | ios_and_ipados | >= unspecified < 13.6 | 13.6 |
| apple | ipados | < 13.6 | 13.6 |
| apple | iphone_os | < 13.6 | 13.6 |
| apple | mac_os_x | < 10.13.6 | 10.13.6 |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | >= 10.14 < 10.14.6 | 10.14.6 |
| apple | mac_os_x | >= 10.15 < 10.15.6 | 10.15.6 |
| apple | macos | >= unspecified < 10.15 | 10.15 |
| apple | macos | >= unspecified < 13.4 | 13.4 |
| apple | macos | >= unspecified < 6.2 | 6.2 |
| apple | macos | >= unspecified < 7.20 | 7.20 |
| apple | macos_catalina_10.15.6_security_update_2020-004_mojave_security_update_2020-004 | — | — |
| apple | tvos | < 13.4.8 | 13.4.8 |
| apple | tvos | — | — |
| apple | watchos | < 6.2.8 | 6.2.8 |
| apple | watchos | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2020-9926: watchOS 6.2.8
vendor_apple·2020-07-15·CVSS 7.8
CVE-2020-9926 [HIGH] CVE-2020-9926: watchOS 6.2.8
Apple Security Update: About the security content of watchOS 6.2.8
Product: watchOS
Version: 6.2.8
CVE: CVE-2020-9926
Component: Kernel
Impact: A malicious application may disclose restricted memory
Description: An information disclosure issue was addressed with improved state management.
Apple
CVE-2020-9926: tvOS 13.4.8
vendor_apple·2020-07-15·CVSS 7.8
CVE-2020-9926 [HIGH] CVE-2020-9926: tvOS 13.4.8
Apple Security Update: About the security content of tvOS 13.4.8
Product: tvOS
Version: 13.4.8
CVE: CVE-2020-9926
Component: Kernel
Impact: A remote attacker may be able to cause a denial of service
Description: A buffer overflow was addressed with improved bounds checking.
Apple
CVE-2020-9926: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
vendor_apple·2020-07-15·CVSS 7.8
CVE-2020-9926 [HIGH] CVE-2020-9926: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Apple Security Update: About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Product: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
CVE: CVE-2020-9926
Component: Kernel
Impact: A malicious application may disclose restricted memory
Description: An information disclosure issue was addressed with improved state management.
Apple
CVE-2020-9926: iOS 13.6 and iPadOS 13.6
vendor_apple·2020-07-15·CVSS 7.8
CVE-2020-9926 [HIGH] CVE-2020-9926: iOS 13.6 and iPadOS 13.6
Apple Security Update: About the security content of iOS 13.6 and iPadOS 13.6
Product: iOS 13.6 and iPadOS
Version: 13.6
CVE: CVE-2020-9926
Component: Kernel
Impact: A remote attacker may be able to cause a denial of service
Description: A buffer overflow was addressed with improved bounds checking.
GHSA
GHSA-q59g-53fj-p9fq: A use after free issue was addressed with improved memory management
ghsa_unreviewed·2022-05-24
CVE-2020-9926 [HIGH] CWE-416 GHSA-q59g-53fj-p9fq: A use after free issue was addressed with improved memory management
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, iCloud for Windows 7.20, macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://support.apple.com/en-us/HT211288https://support.apple.com/en-us/HT211289https://support.apple.com/en-us/HT211290https://support.apple.com/en-us/HT211291https://support.apple.com/en-us/HT211295https://support.apple.com/en-us/HT211288https://support.apple.com/en-us/HT211289https://support.apple.com/en-us/HT211290https://support.apple.com/en-us/HT211291https://support.apple.com/en-us/HT211295
2021-04-02
Published