Details of VAR-202010-1227

ID

VAR-202010-1227

CVE

CVE-2020-9906

TITLE

Apple macOS Catalina Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202010-1233

DESCRIPTION

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple watchOS is a smart watch operating system. Apple iPadOS is an operating system for iPad tablets

Trust: 1.08

sources: NVD: CVE-2020-9906 // VULHUB: VHN-188031 // VULMON: CVE-2020-9906

AFFECTED PRODUCTS

vendor:	apple	model:	mac os x	scope:	gte	version:	10.15	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lt	version:	10.13.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	eq	version:	10.14.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	gte	version:	10.13	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	eq	version:	10.13.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lt	version:	10.15.6	Trust: 1.0
vendor:	apple	model:	ipados	scope:	lt	version:	13.6	Trust: 1.0
vendor:	apple	model:	watchos	scope:	lt	version:	6.2.8	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	lt	version:	13.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lt	version:	10.14.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	gte	version:	10.14	Trust: 1.0

sources: NVD: CVE-2020-9906

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-9906
value:	CRITICAL
Trust: 1.0
CNNVD:	CNNVD-202010-1233
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-188031
value:	HIGH
Trust: 0.1
VULMON:	CVE-2020-9906
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2020-9906
severity:	HIGH
baseScore:	9.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	9.2
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
VULHUB:	VHN-188031
severity:	HIGH
baseScore:	9.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	9.2
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-9906
baseSeverity:	CRITICAL
baseScore:	9.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.2
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-188031 // VULMON: CVE-2020-9906 // CNNVD: CNNVD-202010-1233 // NVD: CVE-2020-9906

PROBLEMTYPE DATA

problemtype:	CWE-20	Trust: 1.1
problemtype:	CWE-787	Trust: 1.1

sources: VULHUB: VHN-188031 // NVD: CVE-2020-9906

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202010-1233

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202010-1233

PATCH

title:

Multiple Apple Product input verification error vulnerability fixes

url:

http://123.124.177.30/web/xxk/bdxqById.tag?id=132073

Trust: 0.6

sources: CNNVD: CNNVD-202010-1233

EXTERNAL IDS

db:	NVD	id:	CVE-2020-9906	Trust: 1.8
db:	PACKETSTORM	id:	162119	Trust: 1.7
db:	CNNVD	id:	CNNVD-202010-1233	Trust: 0.7
db:	NSFOCUS	id:	50127	Trust: 0.6
db:	CNVD	id:	CNVD-2020-59477	Trust: 0.1
db:	VULHUB	id:	VHN-188031	Trust: 0.1
db:	VULMON	id:	CVE-2020-9906	Trust: 0.1

sources: VULHUB: VHN-188031 // VULMON: CVE-2020-9906 // CNNVD: CNNVD-202010-1233 // NVD: CVE-2020-9906

REFERENCES

url:	https://support.apple.com/kb/ht211288	Trust: 1.8
url:	https://support.apple.com/kb/ht211289	Trust: 1.8
url:	https://support.apple.com/kb/ht211291	Trust: 1.8
url:	http://packetstormsecurity.com/files/162119/ios-macos-radio-proximity-kernel-memory-corruption.html	Trust: 1.7
url:	https://support.apple.com/en-us/ht211291	Trust: 0.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-9906	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/50127	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/20.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-188031 // VULMON: CVE-2020-9906 // CNNVD: CNNVD-202010-1233 // NVD: CVE-2020-9906

CREDITS

Google Security Research

Trust: 0.6

sources: CNNVD: CNNVD-202010-1233

SOURCES

db:	VULHUB	id:	VHN-188031
db:	VULMON	id:	CVE-2020-9906
db:	CNNVD	id:	CNNVD-202010-1233
db:	NVD	id:	CVE-2020-9906

LAST UPDATE DATE

2024-11-23T20:09:41.058000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-188031	date:	2023-01-09T00:00:00
db:	VULMON	id:	CVE-2020-9906	date:	2021-04-08T00:00:00
db:	CNNVD	id:	CNNVD-202010-1233	date:	2022-10-13T00:00:00
db:	NVD	id:	CVE-2020-9906	date:	2024-11-21T05:41:30.230

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-188031	date:	2020-10-22T00:00:00
db:	VULMON	id:	CVE-2020-9906	date:	2020-10-22T00:00:00
db:	CNNVD	id:	CNNVD-202010-1233	date:	2020-10-22T00:00:00
db:	NVD	id:	CVE-2020-9906	date:	2020-10-22T19:15:14.400