Apple Macos vulnerabilities

CVE-2020-27950 Medium · 5.5 KEV High · 59 Public exploit CWE-665 Dec 8, 2020

Apple Multiple Products Memory Initialization Vulnerability

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.

CVE-2020-27930 High · 7.8 KEV High · 62 Public exploit CWE-787 Dec 8, 2020

Apple Multiple Products Memory Corruption Vulnerability

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.

CVE-2020-9934 Medium · 5.5 KEV High · 57 Public exploit Oct 16, 2020

Apple iOS, iPadOS, and macOS Input Validation Vulnerability

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

CVE-2020-15358 Medium · 5.5 CWE-787 Jun 27, 2020

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a...

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

CVE-2020-14155 Medium · 5.3 CWE-190 Jun 15, 2020

Integer Overflow or Wraparound in Pcre

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

CVE-2019-20838 High · 7.5 CWE-125 Jun 15, 2020

Out-of-bounds Read in Pcre

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

CVE-2020-9859 High · 7.8 KEV High · 50 CWE-415 Jun 5, 2020

Apple Multiple Products Code Execution Vulnerability

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.

CVE-2020-13631 Medium · 5.5 May 27, 2020

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables...

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

CVE-2020-13630 High · 7.0 CWE-416 May 27, 2020

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the...

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

CVE-2020-13434 Medium · 5.5 CWE-190 May 24, 2020

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

CVE-2020-3837 High · 7.8 KEV High · 64 Public exploit CWE-787 Feb 27, 2020

Apple Multiple Products Memory Corruption Vulnerability

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.

CVE-2019-8605 High · 7.8 KEV Urgent · 70 Public exploit CWE-416 Dec 18, 2019

Apple Multiple Products Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.

CVE-2019-8526 High · 7.8 KEV High · 49 CWE-416 Dec 18, 2019

Apple macOS Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.

CVE-2019-7286 High · 7.8 KEV High · 64 Public exploit CWE-787 Dec 18, 2019

Apple Multiple Products Memory Corruption Vulnerability

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.

CVE-2019-6223 High · 7.5 KEV High · 54 Mar 5, 2019

Apple iOS and macOS Group Facetime Vulnerability

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.

CVE-2013-0340 Medium · 6.8 CWE-611 Jan 21, 2014

expat 2.1.0 and earlier does not properly handle entities expansion unless an application...

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.