Sign-up

ID

VAR-202010-1301


CVE

CVE-2020-9902


TITLE

Multiple Apple Product Buffer Error Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202010-1230

DESCRIPTION

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to determine kernel memory layout. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple iPadOS is an operating system for iPad tablets

Trust: 1.08

sources: NVD: CVE-2020-9902 // VULHUB: VHN-188027 // VULMON: CVE-2020-9902

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:ltversion:10.15.6

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:6.2.8

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:13.6

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:13.4.8

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:13.6

Trust: 1.0

sources: NVD: CVE-2020-9902

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-9902
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202010-1230
value: MEDIUM

Trust: 0.6

VULHUB: VHN-188027
value: HIGH

Trust: 0.1

VULMON: CVE-2020-9902
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-9902
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-188027
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-9902
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-188027 // VULMON: CVE-2020-9902 // CNNVD: CNNVD-202010-1230 // NVD: CVE-2020-9902

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.1

sources: VULHUB: VHN-188027 // NVD: CVE-2020-9902

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202010-1230

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202010-1230

PATCH

title:Multiple Apple Product Buffer Error Vulnerability Fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=132071

Trust: 0.6

sources: CNNVD: CNNVD-202010-1230

EXTERNAL IDS

db:NVDid:CVE-2020-9902

Trust: 1.8

db:CNNVDid:CNNVD-202010-1230

Trust: 0.7

db:NSFOCUSid:50128

Trust: 0.6

db:CNVDid:CNVD-2020-61631

Trust: 0.1

db:VULHUBid:VHN-188027

Trust: 0.1

db:VULMONid:CVE-2020-9902

Trust: 0.1

sources: VULHUB: VHN-188027 // VULMON: CVE-2020-9902 // CNNVD: CNNVD-202010-1230 // NVD: CVE-2020-9902

REFERENCES

url:https://support.apple.com/kb/ht211288

Trust: 1.8

url:https://support.apple.com/kb/ht211289

Trust: 1.8

url:https://support.apple.com/kb/ht211290

Trust: 1.8

url:https://support.apple.com/kb/ht211291

Trust: 1.8

url:https://support.apple.com/en-us/ht211291

Trust: 0.6

url:http://www.nsfocus.net/vulndb/50128

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-9902

Trust: 0.6

url:https://support.apple.com/en-us/ht211290

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/125.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-188027 // VULMON: CVE-2020-9902 // CNNVD: CNNVD-202010-1230 // NVD: CVE-2020-9902

SOURCES

db:VULHUBid:VHN-188027
db:VULMONid:CVE-2020-9902
db:CNNVDid:CNNVD-202010-1230
db:NVDid:CVE-2020-9902

LAST UPDATE DATE

2024-11-23T22:21:00.915000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-188027date:2023-01-09T00:00:00
db:VULMONid:CVE-2020-9902date:2020-10-30T00:00:00
db:CNNVDid:CNNVD-202010-1230date:2021-11-03T00:00:00
db:NVDid:CVE-2020-9902date:2024-11-21T05:41:29.813

SOURCES RELEASE DATE

db:VULHUBid:VHN-188027date:2020-10-22T00:00:00
db:VULMONid:CVE-2020-9902date:2020-10-22T00:00:00
db:CNNVDid:CNNVD-202010-1230date:2020-10-22T00:00:00
db:NVDid:CVE-2020-9902date:2020-10-22T19:15:14.183