cnvd - cnvd-2020-65947

cnvd-2020-65947

Vulnerability from cnvd

Title: 多款Apple产品ImageIO组件越界读取漏洞（CNVD-2020-65947）

Description:

Apple iOS是一套为移动设备所开发的操作系统。Apple tvOS是一套智能电视操作系统。Apple iPadOS是一套用于iPad平板电脑的操作系统。

Apple iOS 13.6之前版本、iPadOS 13.6之前版本、macOS Catalina 10.15.6之前版本、 tvOS 13.4.8之前版本、watchOS 6.2.8之前版本、iTunes for Windows 12.10.8之前版本、iCloud for Windows 11.3之前版本和iCloud for Windows 7.20之前版本的ImageIO存在越界读取漏洞。攻击者可借助恶意图片利用该漏洞导致任意代码执行。

Severity: 中

Patch Name: 多款Apple产品ImageIO组件越界读取漏洞（CNVD-2020-65947）的补丁

Patch Description:

Apple iOS是一套为移动设备所开发的操作系统。Apple tvOS是一套智能电视操作系统。Apple iPadOS是一套用于iPad平板电脑的操作系统。

Formal description:

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://support.apple.com/

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-9984

Impacted products

Name
['Apple iOS <13.6', 'Apple iTunes for Windows <12.10.8', 'Apple iPadOS <13.6', 'Apple macOS Catalina <10.15.6', 'Apple watchOS <6.2.8', 'Apple tvOS <13.4.8', 'Apple iCloud for Windows <7.20', 'Apple iCloud for Windows <11.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-9984",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-9984"
    }
  },
  "description": "Apple iOS\u662f\u4e00\u5957\u4e3a\u79fb\u52a8\u8bbe\u5907\u6240\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002Apple tvOS\u662f\u4e00\u5957\u667a\u80fd\u7535\u89c6\u64cd\u4f5c\u7cfb\u7edf\u3002Apple iPadOS\u662f\u4e00\u5957\u7528\u4e8eiPad\u5e73\u677f\u7535\u8111\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nApple iOS 13.6\u4e4b\u524d\u7248\u672c\u3001iPadOS 13.6\u4e4b\u524d\u7248\u672c\u3001macOS Catalina 10.15.6\u4e4b\u524d\u7248\u672c\u3001 tvOS 13.4.8\u4e4b\u524d\u7248\u672c\u3001watchOS 6.2.8\u4e4b\u524d\u7248\u672c\u3001iTunes for Windows 12.10.8\u4e4b\u524d\u7248\u672c\u3001iCloud for Windows 11.3\u4e4b\u524d\u7248\u672c\u548ciCloud for Windows 7.20\u4e4b\u524d\u7248\u672c\u7684ImageIO\u5b58\u5728\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u56fe\u7247\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://support.apple.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-65947",
  "openTime": "2020-11-24",
  "patchDescription": "Apple iOS\u662f\u4e00\u5957\u4e3a\u79fb\u52a8\u8bbe\u5907\u6240\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002Apple tvOS\u662f\u4e00\u5957\u667a\u80fd\u7535\u89c6\u64cd\u4f5c\u7cfb\u7edf\u3002Apple iPadOS\u662f\u4e00\u5957\u7528\u4e8eiPad\u5e73\u677f\u7535\u8111\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nApple iOS 13.6\u4e4b\u524d\u7248\u672c\u3001iPadOS 13.6\u4e4b\u524d\u7248\u672c\u3001macOS Catalina 10.15.6\u4e4b\u524d\u7248\u672c\u3001 tvOS 13.4.8\u4e4b\u524d\u7248\u672c\u3001watchOS 6.2.8\u4e4b\u524d\u7248\u672c\u3001iTunes for Windows 12.10.8\u4e4b\u524d\u7248\u672c\u3001iCloud for Windows 11.3\u4e4b\u524d\u7248\u672c\u548ciCloud for Windows 7.20\u4e4b\u524d\u7248\u672c\u7684ImageIO\u5b58\u5728\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u56fe\u7247\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eApple\u4ea7\u54c1ImageIO\u7ec4\u4ef6\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\uff08CNVD-2020-65947\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apple  iOS \u003c13.6",
      "Apple iTunes for Windows \u003c12.10.8",
      "Apple iPadOS \u003c13.6",
      "Apple macOS Catalina \u003c10.15.6",
      "Apple watchOS \u003c6.2.8",
      "Apple tvOS \u003c13.4.8",
      "Apple iCloud for Windows \u003c7.20",
      "Apple  iCloud for Windows \u003c11.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-9984",
  "serverity": "\u4e2d",
  "submitTime": "2020-11-02",
  "title": "\u591a\u6b3eApple\u4ea7\u54c1ImageIO\u7ec4\u4ef6\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\uff08CNVD-2020-65947\uff09"
}

CVE-2020-9984 (GCVE-0-2020-9984)

Vulnerability from cvelistv5

Published

2020-10-22 18:06

Modified

2024-08-04 10:50

Severity ?

CWE

Processing a maliciously crafted image may lead to arbitrary code execution

Summary

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.

References

▼	URL	Tags
	https://support.apple.com/kb/HT211289	x_refsource_MISC
	https://support.apple.com/kb/HT211288	x_refsource_MISC
	https://support.apple.com/kb/HT211290	x_refsource_MISC
	https://support.apple.com/kb/HT211291	x_refsource_MISC
	https://support.apple.com/kb/HT211293	x_refsource_MISC
	https://support.apple.com/kb/HT211294	x_refsource_MISC
	https://support.apple.com/kb/HT211295	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Apple

iOS

Version: unspecified < iOS 13.6 and iPadOS 13.6

Apple	macOS	Version: unspecified < macOS Catalina 10.15.6
Apple	tvOS	Version: unspecified < tvOS 13.4.8
Apple	watchOS	Version: unspecified < watchOS 6.2.8
Apple	iTunes for Windows	Version: unspecified < iTunes 12.10.8 for Windows
Apple	iCloud for Windows	Version: unspecified < iCloud for Windows 11.3
Apple	iCloud for Windows (Legacy)	Version: unspecified < iCloud for Windows 7.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:50:57.248Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT211289"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT211288"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT211290"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT211291"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT211293"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT211294"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT211295"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "iOS 13.6 and iPadOS 13.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "macOS Catalina 10.15.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "tvOS 13.4.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "watchOS 6.2.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iTunes for Windows",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "iTunes 12.10.8 for Windows",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iCloud for Windows",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "iCloud for Windows 11.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iCloud for Windows (Legacy)",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "iCloud for Windows 7.20",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing a maliciously crafted image may lead to arbitrary code execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-22T18:06:56",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/kb/HT211289"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/kb/HT211288"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/kb/HT211290"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/kb/HT211291"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/kb/HT211293"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/kb/HT211294"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/kb/HT211295"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2020-9984",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "iOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "iOS 13.6 and iPadOS 13.6"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "macOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "macOS Catalina 10.15.6"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "tvOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "tvOS 13.4.8"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "watchOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "watchOS 6.2.8"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "iTunes for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "iTunes 12.10.8 for Windows"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "iCloud for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "iCloud for Windows 11.3"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "iCloud for Windows (Legacy)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "iCloud for Windows 7.20"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apple"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Processing a maliciously crafted image may lead to arbitrary code execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.apple.com/kb/HT211289",
              "refsource": "MISC",
              "url": "https://support.apple.com/kb/HT211289"
            },
            {
              "name": "https://support.apple.com/kb/HT211288",
              "refsource": "MISC",
              "url": "https://support.apple.com/kb/HT211288"
            },
            {
              "name": "https://support.apple.com/kb/HT211290",
              "refsource": "MISC",
              "url": "https://support.apple.com/kb/HT211290"
            },
            {
              "name": "https://support.apple.com/kb/HT211291",
              "refsource": "MISC",
              "url": "https://support.apple.com/kb/HT211291"
            },
            {
              "name": "https://support.apple.com/kb/HT211293",
              "refsource": "MISC",
              "url": "https://support.apple.com/kb/HT211293"
            },
            {
              "name": "https://support.apple.com/kb/HT211294",
              "refsource": "MISC",
              "url": "https://support.apple.com/kb/HT211294"
            },
            {
              "name": "https://support.apple.com/kb/HT211295",
              "refsource": "MISC",
              "url": "https://support.apple.com/kb/HT211295"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2020-9984",
    "datePublished": "2020-10-22T18:06:56",
    "dateReserved": "2020-03-02T00:00:00",
    "dateUpdated": "2024-08-04T10:50:57.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted