1. CVE-Search
  2. CVE-2020-13524
ID CVE-2020-13524
Summary An out-of-bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 uses SPECS data from binary USD files. A specially crafted malformed file can trigger an out-of-bounds memory access and modification which results in memory corruption. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file.
References
Vulnerable Configurations
  • cpe:2.3:a:pixar:openusd:20.05:*:*:*:*:*:*:*
    cpe:2.3:a:pixar:openusd:20.05:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.1:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.1:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.2:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.2:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.3:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.3:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.4:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.4:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.5:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.5:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.6:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.6:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.6:-:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.6:-:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.6:supplemental_update:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.6:supplemental_update:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.0:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.0:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.1:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.1:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.2:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.2:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.3:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.3:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.4:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.4:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.4:beta4:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.4:beta4:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.5:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.5:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
  • cpe:2.3:o:apple:macos:11.0:*:*:*:*:*:*:*
    cpe:2.3:o:apple:macos:11.0:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:macos:11.0.1:*:*:*:*:*:*:*
    cpe:2.3:o:apple:macos:11.0.1:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 07-06-2022 - 18:36)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:N/A:P
refmap via4
confirm https://support.apple.com/kb/HT212011
fulldisc
  • 20201215 APPLE-SA-2020-12-14-3 macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave
  • 20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1
misc https://talosintelligence.com/vulnerability_reports/TALOS-2020-1125
Last major update 07-06-2022 - 18:36
Published 03-12-2020 - 18:15
Last modified 07-06-2022 - 18:36
Back to Top