Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 6, iOS 13, tvOS 13. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2019-8718
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able t...
CVEs:CVE-2020-9992
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| xcode | affected | apple | — | — |
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Proc...
CVEs:CVE-2020-9883
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| macos | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
CVEs:CVE-2020-9906
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 20...
CVEs:CVE-2019-8746
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 6, iOS 13, tvOS 13. An application may be able to execute arbitrary code with system privileges.
CVEs:CVE-2019-8712
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in iOS 12.1.3, iCloud for Windows 7.10, iTunes 12.9.3 for Windows, Safari 12.0.3, tvOS 12.1.2. Processing maliciously crafted web content may disclose sensitive user inform...
CVEs:CVE-2019-8570
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. A remote attacker may be able to cause a denial of service.
CVEs:CVE-2020-9905
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, watc...
CVEs:CVE-2019-8547
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20....
CVEs:CVE-2020-9876
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| macos | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. A malicious mail server may overwrite arbitrary mail files.
CVEs:CVE-2020-9920
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVEs:CVE-2020-15969
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| macos | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure.
CVEs:CVE-2018-4474
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, iCloud for Windows 7.14, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing...
CVEs:CVE-2019-8751
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipad_os | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6. A remote attacker may be able to cause a denial of service.
CVEs:CVE-2020-9924
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. A remote attacker may cause an unexpected application termination.
CVEs:CVE-2020-9869
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Proc...
CVEs:CVE-2020-9919
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 10.7, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, iCloud for Windows 7.1...
CVEs:CVE-2019-8825
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, iCloud for Windows 7.14, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing...
CVEs:CVE-2019-8773
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipad_os | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, iCloud for Windows 7.14, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing...
CVEs:CVE-2019-8752
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipad_os | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, Safari 13, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously crafted w...
CVEs:CVE-2019-8728
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, Safari 13, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously crafted w...
CVEs:CVE-2019-8734
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. Processing a maliciously crafted USD file may lead to unexpected application termination or arb...
CVEs:CVE-2020-9985
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to execute arbitrary code with sys...
CVEs:CVE-2020-9892
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 6.1.2, iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra. Processi...
CVEs:CVE-2020-3880
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2020-9904
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2020-9863
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted USD file may lead to unexpected application termination...
CVEs:CVE-2020-9880
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6. An applica...
CVEs:CVE-2019-8831
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. Processing a maliciously crafted USD file may lead to unexpected application termination or arbit...
CVEs:CVE-2020-9940
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2019-8824
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
This issue was addressed with improved entitlements. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A sandboxed process may be able to circumvent sandbox restrictions.
CVEs:CVE-2020-9898
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20....
CVEs:CVE-2020-9872
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Proce...
CVEs:CVE-2020-9873
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Proces...
CVEs:CVE-2020-9877
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra. An application may be able to execute arbitrary code with syste...
CVEs:CVE-2020-3863
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15. An application may be able to execute arbitrary code with system privileges.
CVEs:CVE-2019-8776
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20....
CVEs:CVE-2020-9937
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Proce...
CVEs:CVE-2020-9938
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20....
CVEs:CVE-2020-9871
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6, iOS 13. An application may be able ...
CVEs:CVE-2019-8709
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Proce...
CVEs:CVE-2020-9984
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. Processing a maliciously crafted USD file may lead to unexpected application termination or arb...
CVEs:CVE-2020-9882
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. Processing a maliciously crafted USD file may lead to unexpected application termination or arb...
CVEs:CVE-2020-9881
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Proc...
CVEs:CVE-2020-9875
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 13.1 and iPadOS 13.1, watchOS 6, tvOS 13. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2019-8740
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipad_os | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20....
CVEs:CVE-2020-9874
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20....
CVEs:CVE-2020-9879
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 5.2, iCloud for Windows 7.11, iOS 12.2, iTunes 12.9.4 for Windows, Safari 12.1. Processing maliciously crafted web content may lead to arbitr...
CVEs:CVE-2019-8638
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| watchos | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 5.2, iCloud for Windows 7.11, iOS 12.2, iTunes 12.9.4 for Windows, Safari 12.1. Processing maliciously crafted web content may lead to arbitr...
CVEs:CVE-2019-8639
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| watchos | affected | apple | — | — |
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. Some websites may not have appeared in Safari Preferences.
CVEs:CVE-2020-9787
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipad_os | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2020-9899
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. A remote attacker may be able to o...
CVEs:CVE-2020-9782
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, tvOS 12.3, watchOS 5.2.1, macOS Mojave 10.14.5, Security Update 2019-003 Hig...
CVEs:CVE-2019-8612
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2020-9928
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. A malicious application may be able to execute arbitrary code...
CVEs:CVE-2019-8539
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted font file may lead to arbitrary code execution.
CVEs:CVE-2020-9980
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved validation. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, tvOS 13. Processing maliciously crafted web content may lead to arbitrary code execution.
CVEs:CVE-2020-9932
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
A configuration issue was addressed with additional restrictions. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra, iOS 13.3 and ...
CVEs:CVE-2019-8834
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in macOS Catalina 10.15, watchOS 6, iOS 13, tvOS 13. A device may be passively tracked by its Wi-Fi MAC address.
CVEs:CVE-2019-8854
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, iOS 12.3, tvOS 12.3, watchOS 5.3. An application may be able to read ...
CVEs:CVE-2019-8633
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. Processing a mali...
CVEs:CVE-2019-6238
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.0 and iPadOS 14.0. An application may be able to cause unexpected system termination or write kernel memory.
CVEs:CVE-2020-9958
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in Safari 12.0.2, iOS 12.1.1, tvOS 12.1.1, iTunes 12.9.2 for Windows. Processing maliciously crafted web content may disclose sensitive user information.
CVEs:CVE-2018-4444
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0. A malicious application may be able to leak sensitive user information.
CVEs:CVE-2020-9976
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVEs:CVE-2019-8826
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is fixed in Safari 13.0.3, iTunes 12.10.2 for Windows, iCloud for Windows 10.9.2, tvOS 13.2, iOS ...
CVEs:CVE-2019-8827
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, iOS 12.3, tvOS 12.3. Users removed from an iMessage conversation may still b...
CVEs:CVE-2019-8631
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
A logic issue was addressed with improved restrictions. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. A sandboxed process may be able to circumvent sandbox res...
CVEs:CVE-2019-8618
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8....
CVEs:CVE-2020-9868
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
This issue is fixed in macOS Mojave 10.14. A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks.
CVEs:CVE-2018-4296
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 13.0.5. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.
CVEs:CVE-2020-9860
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| safari | affected | apple | — | — |
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. Viewing a maliciously crafted JPEG file may lead to arbitrary code execution.
CVEs:CVE-2020-9887
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6.1, tvOS 13.2, iOS 13.2 and iPadOS 13.2. An application may be able t...
CVEs:CVE-2019-8829
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website.
CVEs:CVE-2020-3852
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| safari | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. A Mac may not lock immediately upon wake.
CVEs:CVE-2019-8851
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to determine kernel memory layout.
CVEs:CVE-2020-9902
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A logic issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, iOS 12.4.3, watchOS 6.1, iOS 13.2 and iPadOS 13.2. AirDrop transfers may be unexpectedly accept...
CVEs:CVE-2019-8796
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to overwrite arbitrary files.
CVEs:CVE-2020-9994
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.7. A malicious application may be able to read sensitive location information.
CVEs:CVE-2020-9986
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
This issue is fixed in macOS Mojave 10.14. A memory corruption issue was addressed with improved input validation.
CVEs:CVE-2018-4451
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.1 and iPadOS 13.1, tvOS 13. A malicious application may be able to determine kernel memory layout.
CVEs:CVE-2019-8780
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| tvos | affected | apple | — | — |
A denial of service issue was addressed with improved validation. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. Processing a maliciously crafted vcf file may l...
CVEs:CVE-2019-8538
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6, watchOS 6.2.8. A malicious application may disclose restricted memory.
CVEs:CVE-2020-9997
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1. Processing a maliciously crafted message may lead to a denial of service.
CVEs:CVE-2019-8664
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| watchos | affected | apple | — | — |
A logic issue was addressed with improved validation. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra. A sandboxed process may be able to circumvent sandbox restrictions.
CVEs:CVE-2019-8640
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6. Processing a ...
CVEs:CVE-2019-8850
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
A validation issue existed in Trust Anchor Management. This issue was addressed with improved validation. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. An untr...
CVEs:CVE-2019-8531
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to determine kernel memory layout.
CVEs:CVE-2020-9853
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An issue existed in the handling of encrypted Mail. This issue was addressed with improved isolation of MIME in Mail. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. An attacker in a p...
CVEs:CVE-2019-8645
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An information disclosure issue existed in the handling of the Storage Access API. This issue was addressed with improved logic. This issue is fixed in iOS 13.3 and iPadOS 13.3, tvOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows. Visiting a malicious...
CVEs:CVE-2019-8898
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Apple Music 3.4.0 for Android. A malicious application may be able to leak a user's credentials.
CVEs:CVE-2020-9982
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| music | affected | apple | — | — |
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Catalina 10.15. A malicious application may be able to access restricted files.
CVEs:CVE-2019-8855
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, watchOS 5, iOS 12, tvOS 12, macOS Mojave 10.14. A malicious applicatio...
CVEs:CVE-2018-4433
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A denial of service issue was addressed with improved validation. This issue is fixed in iOS 12.4, tvOS 12.4, watchOS 5.3. Processing a maliciously crafted image may lead to a denial of service.
CVEs:CVE-2019-8668
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6. A user may be unexpectedly logged in to another user’s account.
CVEs:CVE-2020-9935
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006. A user who shares their screen may not be able to end screen sharing.
CVEs:CVE-2019-8858
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A validation issue was addressed with improved logic. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, tvOS 13, iCloud for Windows 7.14, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may ...
CVEs:CVE-2019-8762
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| icloud | affected | apple | — | — |
| ipad_os | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
| tvos | affected | apple | — | — |
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in watchOS 5.2, iOS 12.2. A malicious application may be able to access restricted files.
CVEs:CVE-2019-8532
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| watchos | affected | apple | — | — |
This issue was addressed by removing additional entitlements. This issue is fixed in macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra. A malicious application may be able to access restricted files.
CVEs:CVE-2018-4468
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15, watchOS 6, iOS 13, tvOS 13. Processing maliciously crafted web content may lead to a cross site scripting attack.
CVEs:CVE-2019-8753
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An issue existed with Siri Suggestions access to encrypted data. The issue was fixed by limiting access to encrypted data. This issue is fixed in macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra. Encrypted d...
CVEs:CVE-2020-9774
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Parsing a maliciously crafted iBooks file may lead to a persistent denial-of-service.
CVEs:CVE-2019-8774
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipad_os | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in tvOS 12.1, iOS 12.1. Processing a maliciously crafted message may lead to a denial of service.
CVEs:CVE-2018-4381
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| tvos | affected | apple | — | — |
This issue was addressed with improved checks This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra. An application may be able to trigger a sysdiagnose.
CVEs:CVE-2020-9786
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
This issue was addressed by verifying host keys when connecting to a previously-known SSH server. This issue is fixed in iOS 13.1 and iPadOS 13.1. An attacker in a privileged network position may be able to intercept SSH traffic from the “Run script ...
CVEs:CVE-2019-8901
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006. A malicious HTML document may be ...
CVEs:CVE-2019-8754
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A trust issue was addressed by removing a legacy API. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0. An attacker may be able to misuse a trust relationship to download malicious content.
CVEs:CVE-2020-9979
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| tvos | affected | apple | — | — |
A logic issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5. An application may be able to gain elevated privileges.
CVEs:CVE-2020-9854
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. A local user may be able to read kernel memory.
CVEs:CVE-2020-9964
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. A malicious application may be ...
CVEs:CVE-2019-8534
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A local attacker may be able ...
CVEs:CVE-2020-9900
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High...
CVEs:CVE-2019-8525
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2020-9927
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. An application may be able to execute arbit...
CVEs:CVE-2019-8528
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| watchos | affected | apple | — | — |
This issue was addresses by updating incorrect URLSession file descriptors management logic to match Swift 5.0. This issue is fixed in Swift 5.1.1 for Ubuntu. Incorrect management of file descriptors in URLSession could lead to inadvertent data disclos...
CVEs:CVE-2019-8790
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| swift | affected | apple | — | — |
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.5. A person with physical access to a Mac may be able to bypass Login Window.
CVEs:CVE-2020-9810
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. A local attacker may be able to elevate thei...
CVEs:CVE-2020-9901
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
This issue was resolved by replacing device names with a random identifier. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15, watchOS 6, tvOS 13. An attacker in physical proximity may be able to passively observe device names in AW...
CVEs:CVE-2019-8799
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. A local atta...
CVEs:CVE-2019-8777
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to cause unexpected system termination or read kernel memory.
CVEs:CVE-2020-9929
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An issue existed in the handling of S-MIME certificates. This issue was addressed with improved validation of S-MIME certificates. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. Proce...
CVEs:CVE-2019-8642
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, watchOS 6, iOS 13. A local app may be able to read a persistent account identifier.
CVEs:CVE-2019-8809
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected system termination or read kernel memory.
CVEs:CVE-2020-9779
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
This issue was addressed with improved checks. This issue is fixed in iOS 14.0 and iPadOS 14.0, watchOS 7.0. The screen lock may not engage after the specified time period.
CVEs:CVE-2020-9946
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| watchos | affected | apple | — | — |
An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. An application may be able to gain elevated privileges.
CVEs:CVE-2019-8579
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to cause unexpected system termination or read kernel memory.
CVEs:CVE-2020-9908
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.1.1, watchOS 5.1.2, macOS Mojave 10.14.2, Security Upd...
CVEs:CVE-2018-4448
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A local user may be able to view sensitive user information.
CVEs:CVE-2020-3918
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipad_os | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| tvos | affected | apple | — | — |
| watchos | affected | apple | — | — |
The issue was addressed with improved data deletion. This issue is fixed in iOS 13. Deleted calls remained visible on the device.
CVEs:CVE-2019-8732
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to overwrite arbitrary files.
CVEs:CVE-2020-3915
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A lock screen issue allowed access to messages on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 14.0 and iPadOS 14.0. A person with physical access to an iOS device may be able to view notification...
CVEs:CVE-2020-9959
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 12.1.1. A local attacker may be able to share items from the lock screen.
CVEs:CVE-2018-4428
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
This issue was addressed with a new entitlement. This issue is fixed in iOS 12.1. A local user may be able to read a persistent device identifier.
CVEs:CVE-2018-4339
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
A race condition was addressed with additional validation. This issue is fixed in macOS Catalina 10.15.6. A malicious application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2020-9990
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A race condition was addressed with improved state handling. This issue is fixed in macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2020-9796
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. A malicious application may be able to execute arbitrary code with system privileges.
CVEs:CVE-2020-9921
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to load unsigned kernel extensions.
CVEs:CVE-2020-9939
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.