GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing support.apple.com — About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra - Apple Support About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High SierraThis document describes the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. About Apple security updatesFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High SierraReleased July 15, 2020
AMD Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-9927: Lilang Wu working with TrendMicro’s Zero Day Initiative Entry updated August 5, 2020
Audio Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-9884: Yu Zhou(@yuzhou6666) of 小鸡帮 working with Trend Micro Zero Day Initiative CVE-2020-9889: Anonymous working with Trend Micro’s Zero Day Initiative, JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab Entry updated August 5, 2020
Audio Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-9888: JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9890: JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9891: JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab Entry updated August 5, 2020
Bluetooth Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2020-9928: Yu Wang of Didi Research America Entry added August 5, 2020
Bluetooth Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.5 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-9929: Yu Wang of Didi Research America Entry added August 5, 2020
Clang Available for: macOS Catalina 10.15.5 Impact: Clang may generate machine code that does not correctly enforce pointer authentication codes Description: A logic issue was addressed with improved validation. CVE-2020-9870: Samuel Groß of Google Project Zero CoreAudio Available for: macOS High Sierra 10.13.6 Impact: A buffer overflow may result in arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2020-9866: Yu Zhou of 小鸡帮 and Jundong Xie of Ant-Financial Light-Year Security Lab Core Bluetooth Available for: macOS Catalina 10.15.5 Impact: A remote attacker may cause an unexpected application termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-9869: Patrick Wardle of Jamf Entry added August 5, 2020
CoreCapture Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed with improved memory management. CVE-2020-9949: Proteas Entry added November 12, 2020
CoreFoundation Available for: macOS Catalina 10.15.5 Impact: A local user may be able to view sensitive user information Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation. CVE-2020-9934: Matt Shockley (linkedin.com/in/shocktop) Entry updated August 5, 2020
CoreGraphics Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2020-9883: an anonymous researcher, Mickey Jin of Trend Micro Entry added July 24, 2020, updated November 12, 2020
Crash Reporter Available for: macOS Catalina 10.15.5 Impact: A malicious application may be able to break out of its sandbox Description: A memory corruption issue was addressed by removing the vulnerable code. CVE-2020-9865: Zhuo Liang of Qihoo 360 Vulcan Team working with 360 BugCloud Crash Reporter Available for: macOS Catalina 10.15.5 Impact: A local attacker may be able to elevate their privileges Description: An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. CVE-2020-9900: Cees Elzinga, Zhongcheng Li (CK01) from Zero-dayits Team of Legendsec at Qi'anxin Group Entry added August 5, 2020, updated December 17, 2021
FontParser Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-9980: Xingwei Lin of Ant Security Light-Year Lab Entry added September 21, 2020, updated October 19, 2020
Graphics Drivers Available for: macOS Catalina 10.15.5 Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-9799: ABC Research s.r.o. Entry updated July 24, 2020
Heimdal Available for: macOS Catalina 10.15.5 Impact: A local user may be able to leak sensitive user information Description: This issue was addressed with improved data protection. CVE-2020-9913: Cody Thomas of SpecterOps ImageIO Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-27933: Xingwei Lin of Ant-Financial Light-Year Security Lab Entry added March 16, 2021
ImageIO Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: Multiple buffer overflow issues existed in openEXR Description: Multiple issues in openEXR were addressed with improved checks. CVE-2020-11758: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-11759: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-11760: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-11761: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-11762: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-11763: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-11764: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-11765: Xingwei Lin of Ant-Financial Light-Year Security Lab Entry added September 8, 2020
ImageIO Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-9871: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9872: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9874: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9879: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9936: Mickey Jin of Trend Micro CVE-2020-9937: Xingwei Lin of Ant-Financial Light-Year Security Lab Entry updated August 5, 2020
ImageIO Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2020-9919: Mickey Jin of Trend Micro Entry added July 24, 2020
ImageIO Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-9876: Mickey Jin of Trend Micro Entry added July 24, 2020
ImageIO Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-9873: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9938: Xingwei Lin of Ant-Financial Light-Year Security Lab Entry added July 24, 2020
ImageIO Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-9877: Xingwei Lin of Ant-Financial Light-Year Security Lab Entry added August 5, 2020
ImageIO Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An integer overflow was addressed through improved input validation. CVE-2020-9875: Mickey Jin of Trend Micro Entry added August 5, 2020
ImageIO Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-9873: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9938: Xingwei Lin of Ant-Financial Light-Year Security Lab CVE-2020-9984: an anonymous researcher Entry added September 21, 2020
Image Processing Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-9887: Mickey Jin of Trend Micro Entry added September 8, 2020
Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-9908: Junzhi Lu(@pwn0rz) working with Trend Micro’s Zero Day Initiative Entry added July 24, 2020, updated August 31, 2020
Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with additional validation. CVE-2020-9990: ABC Research s.r.l. working with Trend Micro Zero Day Initiative, ABC Research s.r.o. working with Trend Micro Zero Day Initiative Entry added September 21, 2020
Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-9921: ABC Research s.r.o. working with Trend Micro Zero Day Initiative Entry added August 5, 2020
Kernel Available for: macOS Catalina 10.15.5 Impact: An attacker in a privileged network position may be able to inject into active connections within a VPN tunnel Description: A routing issue was addressed with improved restrictions. CVE-2019-14899: William J. Tolley, Beau Kujath, and Jedidiah R. Crandall Kernel Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2020-9904: Tielei Wang of Pangu Lab Entry added July 24, 2020
Kernel Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause a denial of service Description: A logic issue was addressed with improved state management. CVE-2020-9924: Matt DeVore of Google Entry added July 24, 2020
Kernel Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: Multiple memory corruption issues were addressed with improved state management. CVE-2020-9892: Andy Nguyen of Google Entry added July 24, 2020
Kernel Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-9863: Xinru Chi of Pangu Lab Entry updated August 5, 2020
Kernel Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: A malicious application may be able to determine kernel memory layout Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-9902: Xinru Chi and Tielei Wang of Pangu Lab Entry added August 5, 2020
Kernel Available for: macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause a denial of service Description: A buffer overflow was addressed with improved bounds checking. CVE-2020-9905: Raz Mashat (@RazMashat) of ZecOps Entry added August 5, 2020
Kernel Available for: macOS Catalina 10.15.5 Impact: A malicious application may disclose restricted memory Description: An information disclosure issue was addressed with improved state management. CVE-2020-9997: Catalin Valeriu Lita of SecurityScorecard Entry added September 21, 2020
libxml2 Available for: macOS Catalina 10.15.5 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-9926: Found by OSS-Fuzz Entry added March 16, 2021
libxpc Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6 Impact: A malicious application may be able to overwrite arbitrary files Description: A path handling issue was addressed with improved validation. CVE-2020-9994: Apple Entry added September 21, 2020
Login Window Available for: macOS Catalina 10.15.5 Impact: A user may be unexpectedly logged in to another user’s account Description: A logic issue was addressed with improved state management. CVE-2020-9935: an anonymous researcher Entry added September 21, 2020
Available for: macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause a denial of service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2019-19906 Entry added July 24, 2020, updated September 8, 2020
Available for: macOS Catalina 10.15.5 Impact: A malicious mail server may overwrite arbitrary mail files Description: A path handling issue was addressed with improved validation. CVE-2020-9920: YongYue Wang AKA BigChan of Hillstone Networks AF Team Entry added July 24, 2020
Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: Processing a maliciously crafted email may lead to writing arbitrary files Description: A logic issue was addressed with improved state management. CVE-2020-9922: Mikko Kenttälä (@Turmio_) of SensorFu Entry added November 12, 2020
Messages Available for: macOS Catalina 10.15.5 Impact: A user that is removed from an iMessage group could rejoin the group Description: An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification. CVE-2020-9885: an anonymous researcher, Suryansh Mansharamani, of WWP High School North (medium.com/@suryanshmansha) Model I/O Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2020-9878: Holger Fuhrmannek of Deutsche Telekom Security Model I/O Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.5 Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2020-9880: Holger Fuhrmannek of Deutsche Telekom Security Entry added July 24, 2020, updated September 21, 2020
Model I/O Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.5 Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2020-9878: Aleksandar Nikolic of Cisco Talos, Holger Fuhrmannek of Deutsche Telekom Security CVE-2020-9881: Holger Fuhrmannek of Deutsche Telekom Security CVE-2020-9882: Holger Fuhrmannek of Deutsche Telekom Security CVE-2020-9940: Holger Fuhrmannek of Deutsche Telekom Security CVE-2020-9985: Holger Fuhrmannek of Deutsche Telekom Security Entry added July 24, 2020, updated September 21, 2020
OpenLDAP Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause a denial of service Description: This issue was addressed with improved checks. CVE-2020-12243 Entry added September 21, 2020
Perl Available for: macOS Catalina 10.15.5 Impact: An integer overflow in the Perl regular expression compiler may allow a remote attacker to insert instructions into the compiled form of a regular expression Description: This issue was addressed with improved checks. CVE-2020-10878: Hugo van der Sanden and Slaven Rezic Entry added March 16, 2021
Perl Available for: macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause arbitrary code execution Description: This issue was addressed with improved checks. CVE-2020-12723: Sergey Aleynikov Entry added March 16, 2021
rsync Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6 Impact: A remote attacker may be able to overwrite existing files Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. CVE-2014-9512: gaojianfeng Entry added July 24, 2020
Sandbox Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.5 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-9930: Zhiyi Zhang from Codesafe Team of Legendsec at Qi'anxin Group Entry added December 15, 2020
Sandbox Available for: macOS Catalina 10.15.5 Impact: A local user may be able to load unsigned kernel extensions Description: This issue was addressed with improved checks. CVE-2020-9939: @jinmo123, @setuid0x0_, and @insu_yun_en of @SSLab_Gatech working with Trend Micro’s Zero Day Initiative Entry added August 5, 2020
Security Available for: macOS Catalina 10.15.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A logic issue was addressed with improved restrictions. CVE-2020-9864: Alexander Holodny Security Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate Description: A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. CVE-2020-9868: Brian Wolff of Asana Entry added July 24, 2020
Security Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6 Impact: An application may be able to gain elevated privileges Description: A logic issue was addressed with improved validation. CVE-2020-9854: Ilias Morad (A2nkF) Entry added July 24, 2020
sysdiagnose Available for: macOS Catalina 10.15.5 Impact: A local attacker may be able to elevate their privileges Description: An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. CVE-2020-9901: Tim Michaud (@TimGMichaud) of Leviathan, Zhongcheng Li (CK01) from Zero-dayits Team of Legendsec at Qi'anxin Group Entry added August 5, 2020, updated August 31, 2020
Vim Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause arbitrary code execution Description: This issue was addressed with improved checks. CVE-2019-20807: Guilherme de Almeida Suckevicz WebDAV Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: This issue was addressed with improved entitlements. CVE-2020-9898: Sreejith Krishnan R (@skr0x1C0) Entry added September 8, 2020
Wi-Fi Available for: macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-9918: Jianjun Dai of 360 Alpha Lab working with 360 BugCloud (bugcloud.360.cn) Wi-Fi Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-9899: Yu Wang of Didi Research America Entry added July 24, 2020
Wi-Fi Available for: macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-9906: Ian Beer of Google Project Zero Entry added July 24, 2020
Additional recognitionCoreFoundation We would like to acknowledge Bobby Pelletier for their assistance. Entry added September 8, 2020
ImageIO We would like to acknowledge Xingwei Lin of Ant-Financial Light-Year Security Lab for their assistance. Entry added September 21, 2020
Siri We would like to acknowledge Yuval Ron, Amichai Shulman, and Eli Biham of the Technion - Israel Institute of Technology for their assistance. Entry added August 5, 2020
USB Audio We would like to acknowledge Andy Davis of NCC Group for their assistance. Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.
Published Date:
Character limit:
250
Maximum character limit is 250.
Thanks for your feedback.
|
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |