VARIoT IoT vulnerabilities database

This issue was addressed with improved setting propagation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Turning off "Load remote content in messages” may not apply to all mail previews. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Mail is one of those email plugins. Apple iPadOS is an operating system for iPad tablets. There is a security vulnerability in the Mail component in versions before Apple iOS 13.3.1 and iPadOS 13.3.1. An attacker could exploit this vulnerability to bypass security restrictions and gain access to the system. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1 iOS 13.3.1 and iPadOS 13.3.1 are now available and address the following: Audio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team FaceTime Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A remote FaceTime user may be able to cause the local user's camera self-view to display the incorrect camera Description: An issue existed in the handling of the local user's self-view. CVE-2020-3869: Elisa Lee ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero IOAcceleratorFamily Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3858: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc, Luyi Xing of Indiana University Bloomington Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2020-3831: Corellium, Proteas of Qihoo 360 Nirvan Team Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3860: Proteas of Qihoo 360 Nirvan Team libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero Mail Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Turning off "Load remote content in messages" may not apply to all mail previews Description: This issue was addressed with improved setting propagation. CVE-2020-3873: Alexander Heinrich (@Sn0wfreeze) of Technische Universität Darmstadt Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: An inconsistent user interface issue was addressed with improved state management. CVE-2020-3859: Simone PC of X10X (TWR) Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Users removed from an iMessage conversation may still be able to alter state Description: This issue was addressed with improved checks. CVE-2020-3844: Lance Rodgers of Oxon Hill High School Phone Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2020-3828: an anonymous researcher Safari Login AutoFill Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A local user may unknowingly send a password unencrypted over the network Description: The issue was addressed with improved UI handling. CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research Screenshots Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Screenshots of the Messages app may reveal additional message content Description: An issued existed in the naming of screenshots. CVE-2020-3874: Nicolas Luckie of Durham College wifivelocityd Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition IOSurface We would like to acknowledge Liang Chen (@chenliang0817) for their assistance. Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.3.1 and iPadOS 13.3.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y 0M3JFg/9HBcMDffgGWKqqWc7O+CoqqogA+LPrEz+iGn8clEC3El9kr+i6Q1Lk4Pw RqE+v88E6jp11puj7g5/i5Fi4QzTZT2Y4wxfgAtNVJRfzak3AqDINswwSCrO/+q/ v+HnvErqH1QXH/AOX/PwU4/D+GQWOuxCsgiXyeLGDZKvjxxu+9T6BnbG594+pdxF lIfbnYRTObJ3K9dumQg/lK8f6AxOgJChUYddZGOvE8kcfeheGRSrl/Pp/uoTUhSd Vf4qnqVq7fmmGgaKaMZ5acQARP4KeS97C9R/SB6PT3HLsMpEOMq6dmGd1Ma8Atvx CvwrOAkZagAzUWmJQKIR+UkGrnBUyW+1w2XYExLEXKbyOEO9BUvPVCo+0xFLZi2C LrCYNVHTKVmCxDO3FmsIOIn39Fk3w9dDilEOLh+usFKYDclsahVvjpCtIinKGSkF WaijwWPQUwDXEL6NjaS6i42l7zUj/Of3Nw5MZGxyMpKsn//hu24n1p+b52ky9Iha xQAyIPZo+ChJqJI3+GqyW/20YLOyJSOOKrkN0m9GOa7ovPR99iyNRuX+NrUqfCby hHcrkjP3ONIc4ADXXpKao22ERcHEBeCuIfzUgA1V94B3sF7+Abqdt2G8SDHc7ftx o8jh2jBj4V360kxs6736hjY+X5YHYDBzYJ4iJTxwOhdGGLqmDo4= =4Udc -----END PGP SIGNATURE-----

An issue existed in the handling of the local user's self-view. The issue was corrected with improved logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A remote FaceTime user may be able to cause the local user's camera self-view to display the incorrect camera. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. FaceTime is one of those video calling software. A security vulnerability exists in the FaceTime component of Apple iOS 13.3.1 and iPadOS prior to 13.3.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1 iOS 13.3.1 and iPadOS 13.3.1 are now available and address the following: Audio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3869: Elisa Lee ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero IOAcceleratorFamily Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3858: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc, Luyi Xing of Indiana University Bloomington Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2020-3831: Corellium, Proteas of Qihoo 360 Nirvan Team Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3860: Proteas of Qihoo 360 Nirvan Team libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero Mail Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Turning off "Load remote content in messages" may not apply to all mail previews Description: This issue was addressed with improved setting propagation. CVE-2020-3873: Alexander Heinrich (@Sn0wfreeze) of Technische Universität Darmstadt Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: An inconsistent user interface issue was addressed with improved state management. CVE-2020-3859: Simone PC of X10X (TWR) Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Users removed from an iMessage conversation may still be able to alter state Description: This issue was addressed with improved checks. CVE-2020-3844: Lance Rodgers of Oxon Hill High School Phone Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2020-3828: an anonymous researcher Safari Login AutoFill Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A local user may unknowingly send a password unencrypted over the network Description: The issue was addressed with improved UI handling. CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research Screenshots Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Screenshots of the Messages app may reveal additional message content Description: An issued existed in the naming of screenshots. CVE-2020-3874: Nicolas Luckie of Durham College wifivelocityd Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition IOSurface We would like to acknowledge Liang Chen (@chenliang0817) for their assistance. Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.3.1 and iPadOS 13.3.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y 0M3JFg/9HBcMDffgGWKqqWc7O+CoqqogA+LPrEz+iGn8clEC3El9kr+i6Q1Lk4Pw RqE+v88E6jp11puj7g5/i5Fi4QzTZT2Y4wxfgAtNVJRfzak3AqDINswwSCrO/+q/ v+HnvErqH1QXH/AOX/PwU4/D+GQWOuxCsgiXyeLGDZKvjxxu+9T6BnbG594+pdxF lIfbnYRTObJ3K9dumQg/lK8f6AxOgJChUYddZGOvE8kcfeheGRSrl/Pp/uoTUhSd Vf4qnqVq7fmmGgaKaMZ5acQARP4KeS97C9R/SB6PT3HLsMpEOMq6dmGd1Ma8Atvx CvwrOAkZagAzUWmJQKIR+UkGrnBUyW+1w2XYExLEXKbyOEO9BUvPVCo+0xFLZi2C LrCYNVHTKVmCxDO3FmsIOIn39Fk3w9dDilEOLh+usFKYDclsahVvjpCtIinKGSkF WaijwWPQUwDXEL6NjaS6i42l7zUj/Of3Nw5MZGxyMpKsn//hu24n1p+b52ky9Iha xQAyIPZo+ChJqJI3+GqyW/20YLOyJSOOKrkN0m9GOa7ovPR99iyNRuX+NrUqfCby hHcrkjP3ONIc4ADXXpKao22ERcHEBeCuIfzUgA1V94B3sF7+Abqdt2G8SDHc7ftx o8jh2jBj4V360kxs6736hjY+X5YHYDBzYJ4iJTxwOhdGGLqmDo4= =4Udc -----END PGP SIGNATURE-----

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A person with physical access to an iOS device may be able to access contacts from the lock screen. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Messages is one of the application components for sending texts, photos and videos. A security vulnerability exists in the Messages component in Apple iOS versions prior to 13.3.1 and iPadOS versions prior to 13.3.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1 iOS 13.3.1 and iPadOS 13.3.1 are now available and address the following: Audio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team FaceTime Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A remote FaceTime user may be able to cause the local user's camera self-view to display the incorrect camera Description: An issue existed in the handling of the local user's self-view. The issue was corrected with improved logic. CVE-2020-3869: Elisa Lee ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero IOAcceleratorFamily Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3858: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc, Luyi Xing of Indiana University Bloomington Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2020-3831: Corellium, Proteas of Qihoo 360 Nirvan Team Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3860: Proteas of Qihoo 360 Nirvan Team libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero Mail Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Turning off "Load remote content in messages" may not apply to all mail previews Description: This issue was addressed with improved setting propagation. CVE-2020-3873: Alexander Heinrich (@Sn0wfreeze) of Technische Universität Darmstadt Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: An inconsistent user interface issue was addressed with improved state management. CVE-2020-3859: Simone PC of X10X (TWR) Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Users removed from an iMessage conversation may still be able to alter state Description: This issue was addressed with improved checks. CVE-2020-3828: an anonymous researcher Safari Login AutoFill Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A local user may unknowingly send a password unencrypted over the network Description: The issue was addressed with improved UI handling. CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research Screenshots Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Screenshots of the Messages app may reveal additional message content Description: An issued existed in the naming of screenshots. The issue was corrected with improved naming. CVE-2020-3874: Nicolas Luckie of Durham College wifivelocityd Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition IOSurface We would like to acknowledge Liang Chen (@chenliang0817) for their assistance. Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.3.1 and iPadOS 13.3.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y 0M3JFg/9HBcMDffgGWKqqWc7O+CoqqogA+LPrEz+iGn8clEC3El9kr+i6Q1Lk4Pw RqE+v88E6jp11puj7g5/i5Fi4QzTZT2Y4wxfgAtNVJRfzak3AqDINswwSCrO/+q/ v+HnvErqH1QXH/AOX/PwU4/D+GQWOuxCsgiXyeLGDZKvjxxu+9T6BnbG594+pdxF lIfbnYRTObJ3K9dumQg/lK8f6AxOgJChUYddZGOvE8kcfeheGRSrl/Pp/uoTUhSd Vf4qnqVq7fmmGgaKaMZ5acQARP4KeS97C9R/SB6PT3HLsMpEOMq6dmGd1Ma8Atvx CvwrOAkZagAzUWmJQKIR+UkGrnBUyW+1w2XYExLEXKbyOEO9BUvPVCo+0xFLZi2C LrCYNVHTKVmCxDO3FmsIOIn39Fk3w9dDilEOLh+usFKYDclsahVvjpCtIinKGSkF WaijwWPQUwDXEL6NjaS6i42l7zUj/Of3Nw5MZGxyMpKsn//hu24n1p+b52ky9Iha xQAyIPZo+ChJqJI3+GqyW/20YLOyJSOOKrkN0m9GOa7ovPR99iyNRuX+NrUqfCby hHcrkjP3ONIc4ADXXpKao22ERcHEBeCuIfzUgA1V94B3sF7+Abqdt2G8SDHc7ftx o8jh2jBj4V360kxs6736hjY+X5YHYDBzYJ4iJTxwOhdGGLqmDo4= =4Udc -----END PGP SIGNATURE-----

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code with kernel privileges. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Kernel is one of the kernel components. A security vulnerability exists in the Kernel component of Apple iOS versions prior to 13.3.1 and iPadOS versions prior to 13.3.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1 iOS 13.3.1 and iPadOS 13.3.1 are now available and address the following: Audio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team FaceTime Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A remote FaceTime user may be able to cause the local user's camera self-view to display the incorrect camera Description: An issue existed in the handling of the local user's self-view. CVE-2020-3869: Elisa Lee ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero IOAcceleratorFamily Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3858: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc, Luyi Xing of Indiana University Bloomington Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2020-3831: Corellium, Proteas of Qihoo 360 Nirvan Team Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3860: Proteas of Qihoo 360 Nirvan Team libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero Mail Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Turning off "Load remote content in messages" may not apply to all mail previews Description: This issue was addressed with improved setting propagation. CVE-2020-3873: Alexander Heinrich (@Sn0wfreeze) of Technische Universität Darmstadt Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: An inconsistent user interface issue was addressed with improved state management. CVE-2020-3859: Simone PC of X10X (TWR) Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Users removed from an iMessage conversation may still be able to alter state Description: This issue was addressed with improved checks. CVE-2020-3844: Lance Rodgers of Oxon Hill High School Phone Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2020-3828: an anonymous researcher Safari Login AutoFill Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A local user may unknowingly send a password unencrypted over the network Description: The issue was addressed with improved UI handling. CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research Screenshots Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Screenshots of the Messages app may reveal additional message content Description: An issued existed in the naming of screenshots. CVE-2020-3874: Nicolas Luckie of Durham College wifivelocityd Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition IOSurface We would like to acknowledge Liang Chen (@chenliang0817) for their assistance. Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.3.1 and iPadOS 13.3.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y 0M3JFg/9HBcMDffgGWKqqWc7O+CoqqogA+LPrEz+iGn8clEC3El9kr+i6Q1Lk4Pw RqE+v88E6jp11puj7g5/i5Fi4QzTZT2Y4wxfgAtNVJRfzak3AqDINswwSCrO/+q/ v+HnvErqH1QXH/AOX/PwU4/D+GQWOuxCsgiXyeLGDZKvjxxu+9T6BnbG594+pdxF lIfbnYRTObJ3K9dumQg/lK8f6AxOgJChUYddZGOvE8kcfeheGRSrl/Pp/uoTUhSd Vf4qnqVq7fmmGgaKaMZ5acQARP4KeS97C9R/SB6PT3HLsMpEOMq6dmGd1Ma8Atvx CvwrOAkZagAzUWmJQKIR+UkGrnBUyW+1w2XYExLEXKbyOEO9BUvPVCo+0xFLZi2C LrCYNVHTKVmCxDO3FmsIOIn39Fk3w9dDilEOLh+usFKYDclsahVvjpCtIinKGSkF WaijwWPQUwDXEL6NjaS6i42l7zUj/Of3Nw5MZGxyMpKsn//hu24n1p+b52ky9Iha xQAyIPZo+ChJqJI3+GqyW/20YLOyJSOOKrkN0m9GOa7ovPR99iyNRuX+NrUqfCby hHcrkjP3ONIc4ADXXpKao22ERcHEBeCuIfzUgA1V94B3sF7+Abqdt2G8SDHc7ftx o8jh2jBj4V360kxs6736hjY+X5YHYDBzYJ4iJTxwOhdGGLqmDo4= =4Udc -----END PGP SIGNATURE-----

This issue was addressed with improved checks. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Users removed from an iMessage conversation may still be able to alter state. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Messages is one of the application components for sending texts, photos and videos. A security vulnerability exists in the Messages component in Apple iOS versions prior to 13.3.1 and iPadOS versions prior to 13.3.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1 iOS 13.3.1 and iPadOS 13.3.1 are now available and address the following: Audio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team FaceTime Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A remote FaceTime user may be able to cause the local user's camera self-view to display the incorrect camera Description: An issue existed in the handling of the local user's self-view. CVE-2020-3869: Elisa Lee ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero IOAcceleratorFamily Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3858: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc, Luyi Xing of Indiana University Bloomington Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2020-3831: Corellium, Proteas of Qihoo 360 Nirvan Team Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3860: Proteas of Qihoo 360 Nirvan Team libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero Mail Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Turning off "Load remote content in messages" may not apply to all mail previews Description: This issue was addressed with improved setting propagation. CVE-2020-3873: Alexander Heinrich (@Sn0wfreeze) of Technische Universität Darmstadt Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: An inconsistent user interface issue was addressed with improved state management. CVE-2020-3859: Simone PC of X10X (TWR) Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Users removed from an iMessage conversation may still be able to alter state Description: This issue was addressed with improved checks. CVE-2020-3844: Lance Rodgers of Oxon Hill High School Phone Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2020-3828: an anonymous researcher Safari Login AutoFill Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A local user may unknowingly send a password unencrypted over the network Description: The issue was addressed with improved UI handling. CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research Screenshots Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Screenshots of the Messages app may reveal additional message content Description: An issued existed in the naming of screenshots. CVE-2020-3874: Nicolas Luckie of Durham College wifivelocityd Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition IOSurface We would like to acknowledge Liang Chen (@chenliang0817) for their assistance. Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.3.1 and iPadOS 13.3.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y 0M3JFg/9HBcMDffgGWKqqWc7O+CoqqogA+LPrEz+iGn8clEC3El9kr+i6Q1Lk4Pw RqE+v88E6jp11puj7g5/i5Fi4QzTZT2Y4wxfgAtNVJRfzak3AqDINswwSCrO/+q/ v+HnvErqH1QXH/AOX/PwU4/D+GQWOuxCsgiXyeLGDZKvjxxu+9T6BnbG594+pdxF lIfbnYRTObJ3K9dumQg/lK8f6AxOgJChUYddZGOvE8kcfeheGRSrl/Pp/uoTUhSd Vf4qnqVq7fmmGgaKaMZ5acQARP4KeS97C9R/SB6PT3HLsMpEOMq6dmGd1Ma8Atvx CvwrOAkZagAzUWmJQKIR+UkGrnBUyW+1w2XYExLEXKbyOEO9BUvPVCo+0xFLZi2C LrCYNVHTKVmCxDO3FmsIOIn39Fk3w9dDilEOLh+usFKYDclsahVvjpCtIinKGSkF WaijwWPQUwDXEL6NjaS6i42l7zUj/Of3Nw5MZGxyMpKsn//hu24n1p+b52ky9Iha xQAyIPZo+ChJqJI3+GqyW/20YLOyJSOOKrkN0m9GOa7ovPR99iyNRuX+NrUqfCby hHcrkjP3ONIc4ADXXpKao22ERcHEBeCuIfzUgA1V94B3sF7+Abqdt2G8SDHc7ftx o8jh2jBj4V360kxs6736hjY+X5YHYDBzYJ4iJTxwOhdGGLqmDo4= =4Udc -----END PGP SIGNATURE-----

A race condition was addressed with improved locking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code with kernel privileges. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Kernel is one of the kernel components. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1 iOS 13.3.1 and iPadOS 13.3.1 are now available and address the following: Audio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team FaceTime Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A remote FaceTime user may be able to cause the local user's camera self-view to display the incorrect camera Description: An issue existed in the handling of the local user's self-view. The issue was corrected with improved logic. CVE-2020-3869: Elisa Lee ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero IOAcceleratorFamily Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3858: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc, Luyi Xing of Indiana University Bloomington Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2020-3831: Corellium, Proteas of Qihoo 360 Nirvan Team Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3860: Proteas of Qihoo 360 Nirvan Team libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero Mail Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Turning off "Load remote content in messages" may not apply to all mail previews Description: This issue was addressed with improved setting propagation. CVE-2020-3873: Alexander Heinrich (@Sn0wfreeze) of Technische Universität Darmstadt Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: An inconsistent user interface issue was addressed with improved state management. CVE-2020-3859: Simone PC of X10X (TWR) Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Users removed from an iMessage conversation may still be able to alter state Description: This issue was addressed with improved checks. CVE-2020-3844: Lance Rodgers of Oxon Hill High School Phone Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2020-3828: an anonymous researcher Safari Login AutoFill Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A local user may unknowingly send a password unencrypted over the network Description: The issue was addressed with improved UI handling. CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research Screenshots Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Screenshots of the Messages app may reveal additional message content Description: An issued existed in the naming of screenshots. The issue was corrected with improved naming. CVE-2020-3874: Nicolas Luckie of Durham College wifivelocityd Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition IOSurface We would like to acknowledge Liang Chen (@chenliang0817) for their assistance. Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.3.1 and iPadOS 13.3.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y 0M3JFg/9HBcMDffgGWKqqWc7O+CoqqogA+LPrEz+iGn8clEC3El9kr+i6Q1Lk4Pw RqE+v88E6jp11puj7g5/i5Fi4QzTZT2Y4wxfgAtNVJRfzak3AqDINswwSCrO/+q/ v+HnvErqH1QXH/AOX/PwU4/D+GQWOuxCsgiXyeLGDZKvjxxu+9T6BnbG594+pdxF lIfbnYRTObJ3K9dumQg/lK8f6AxOgJChUYddZGOvE8kcfeheGRSrl/Pp/uoTUhSd Vf4qnqVq7fmmGgaKaMZ5acQARP4KeS97C9R/SB6PT3HLsMpEOMq6dmGd1Ma8Atvx CvwrOAkZagAzUWmJQKIR+UkGrnBUyW+1w2XYExLEXKbyOEO9BUvPVCo+0xFLZi2C LrCYNVHTKVmCxDO3FmsIOIn39Fk3w9dDilEOLh+usFKYDclsahVvjpCtIinKGSkF WaijwWPQUwDXEL6NjaS6i42l7zUj/Of3Nw5MZGxyMpKsn//hu24n1p+b52ky9Iha xQAyIPZo+ChJqJI3+GqyW/20YLOyJSOOKrkN0m9GOa7ovPR99iyNRuX+NrUqfCby hHcrkjP3ONIc4ADXXpKao22ERcHEBeCuIfzUgA1V94B3sF7+Abqdt2G8SDHc7ftx o8jh2jBj4V360kxs6736hjY+X5YHYDBzYJ4iJTxwOhdGGLqmDo4= =4Udc -----END PGP SIGNATURE-----

A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A person with physical access to an iOS device may be able to access contacts from the lock screen. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Phone is one of the phone components. A security vulnerability exists in the Phone component in Apple iOS versions prior to 13.3.1 and iPadOS versions prior to 13.3.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1 iOS 13.3.1 and iPadOS 13.3.1 are now available and address the following: Audio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team FaceTime Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A remote FaceTime user may be able to cause the local user's camera self-view to display the incorrect camera Description: An issue existed in the handling of the local user's self-view. CVE-2020-3869: Elisa Lee ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero IOAcceleratorFamily Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3858: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc, Luyi Xing of Indiana University Bloomington Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2020-3831: Corellium, Proteas of Qihoo 360 Nirvan Team Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3860: Proteas of Qihoo 360 Nirvan Team libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero Mail Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Turning off "Load remote content in messages" may not apply to all mail previews Description: This issue was addressed with improved setting propagation. CVE-2020-3873: Alexander Heinrich (@Sn0wfreeze) of Technische Universität Darmstadt Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: An inconsistent user interface issue was addressed with improved state management. CVE-2020-3859: Simone PC of X10X (TWR) Messages Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Users removed from an iMessage conversation may still be able to alter state Description: This issue was addressed with improved checks. CVE-2020-3828: an anonymous researcher Safari Login AutoFill Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A local user may unknowingly send a password unencrypted over the network Description: The issue was addressed with improved UI handling. CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research Screenshots Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Screenshots of the Messages app may reveal additional message content Description: An issued existed in the naming of screenshots. CVE-2020-3874: Nicolas Luckie of Durham College wifivelocityd Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition IOSurface We would like to acknowledge Liang Chen (@chenliang0817) for their assistance. Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.3.1 and iPadOS 13.3.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y 0M3JFg/9HBcMDffgGWKqqWc7O+CoqqogA+LPrEz+iGn8clEC3El9kr+i6Q1Lk4Pw RqE+v88E6jp11puj7g5/i5Fi4QzTZT2Y4wxfgAtNVJRfzak3AqDINswwSCrO/+q/ v+HnvErqH1QXH/AOX/PwU4/D+GQWOuxCsgiXyeLGDZKvjxxu+9T6BnbG594+pdxF lIfbnYRTObJ3K9dumQg/lK8f6AxOgJChUYddZGOvE8kcfeheGRSrl/Pp/uoTUhSd Vf4qnqVq7fmmGgaKaMZ5acQARP4KeS97C9R/SB6PT3HLsMpEOMq6dmGd1Ma8Atvx CvwrOAkZagAzUWmJQKIR+UkGrnBUyW+1w2XYExLEXKbyOEO9BUvPVCo+0xFLZi2C LrCYNVHTKVmCxDO3FmsIOIn39Fk3w9dDilEOLh+usFKYDclsahVvjpCtIinKGSkF WaijwWPQUwDXEL6NjaS6i42l7zUj/Of3Nw5MZGxyMpKsn//hu24n1p+b52ky9Iha xQAyIPZo+ChJqJI3+GqyW/20YLOyJSOOKrkN0m9GOa7ovPR99iyNRuX+NrUqfCby hHcrkjP3ONIc4ADXXpKao22ERcHEBeCuIfzUgA1V94B3sF7+Abqdt2G8SDHc7ftx o8jh2jBj4V360kxs6736hjY+X5YHYDBzYJ4iJTxwOhdGGLqmDo4= =4Udc -----END PGP SIGNATURE-----

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra. A malicious application may be able to overwrite arbitrary files. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A security vulnerability exists in the System component of Apple macOS Catalina versions prior to 10.15.3. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043 Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit) Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A buffer error vulnerability exists in the CoreBluetooth component of Apple macOS Catalina versions prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A buffer error vulnerability exists in the CoreBluetooth component of Apple macOS Catalina versions prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A buffer error vulnerability exists in the CoreBluetooth component of Apple macOS Catalina versions prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to leak memory. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A security vulnerability exists in the CoreBluetooth component of Apple macOS Catalina versions prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043 Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit) Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with kernel privileges. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. Kernel is one of the kernel components. A security vulnerability exists in the Kernel component of Apple macOS Catalina versions prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

This was addressed with additional checks by Gatekeeper on files mounted through a network share. This issue is fixed in macOS Catalina 10.15.3. Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A security vulnerability exists in the autofs component of Apple macOS Catalina versions prior to 10.15.3. An attacker could exploit this vulnerability to bypass access control. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043 Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit) Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with system privileges. macOS Catalina Is vulnerable to memory corruption due to improper memory processing.Arbitrary code can be executed by obtaining system privileges through the application. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A security vulnerability exists in the Security component of Apple macOS Catalina versions prior to 10.15.3. An attacker could exploit this vulnerability to bypass sandbox restrictions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution. are all products of Apple (Apple). Apple iTunes for Windows is a media player application based on the Windows platform. Apple watchOS is a smart watch operating system. Apple macOS Catalina is a dedicated operating system developed for Mac computers. libxml2 is one of the function library components based on C language for parsing XML documents. A security vulnerability exists in the libxml2 component of several Apple products. The following products and versions are affected: Windows-based versions of iCloud prior to 10.9.2, versions prior to 7.17; Windows-based versions of iTunes prior to 12.10.4; versions prior to tvOS 13.3.1; versions prior to watchOS 6.1.2; macOS Catalina 10.15 Versions prior to .3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043 Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit) Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with system privileges. macOS Catalina Is vulnerable to memory corruption due to improper memory processing.Arbitrary code can be executed by obtaining system privileges through the application. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. Intel Graphics Driver is one of the integrated graphics drivers. A security vulnerability exists in the Intel Graphics Driver component of Apple macOS Catalina prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7, watchOS 5.3.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. Wi-Fi is one of the wireless Internet access components. A buffer error vulnerability exists in the Wi-Fi component of Apple macOS Catalina versions prior to 10.15.3. Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----= . CVE-2020-3843: Ian Beer of Google Project Zero Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.4.7". -----BEGIN PGP SIGNATURE----- Version: BCPG v1.64 iQIcBAEDCAAGBQJezV7QAAoJEAc+Lhnt8tDNuPEQAJnAwO9sbgdfm+qVVOLipUKF 6Vxmy9609KqDujTnVhylCRKTsieK3sIuHo9UIdJ63A2MCO9SL4PamKH4z63GnZTF Tx2DVv4UjfhiyqbbhOcCZVUUw80Z63L9nwcmtN8+VcFSCkOr3WHLTrTvd39HgaB7 Tehasa2NkN3E3c/Zmm2aQOIMrKmomMMF1eFn6eEMrlpSKNgqgzfo8QUhWEHiJsS/ RaFPRkZRKKmw+Y1MweCukqSi8bOzKNKBFahDmD7noHCtkHy0bFL85BFiist6cCX5 VxD3unfexYYmBwt466I++y49HVG6JrNyIsMEg6FayR8wrbewszDVh1YarHKwaZlI JrZpmzJwTed1QGOoQ6TBiz1uMjkcc38ae0vkl/UV79c30mI2mdq1hj/FgnrXbF4C HpoTDyDcN7bharGmVBWiPpZfaNGEZzjzg9ATn4oHnihMI2oNPJyiNsezNcczvOot hqJlW4Z78L+VucXZsaRNDciilMBKpWRTxzIvfZwMiEOCPU5uy4T0ou78XH/x2xju 4rSAbG+R9mx8VB2G9CHODyyR0xIQ1y2NiqUBDpP6O3pehBHlMaa21q6k/gAe05a5 lO+NH75EI0/uQDfJSrCj2WbD9riuJsQToU+KY7QOXk2iotY+LC/79gGo2G9cYVAN k7FzJH9C4lVimiOjFauD =h/Qh -----END PGP SIGNATURE-----

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An application may be able to read restricted memory. This vulnerability allows local attackers to disclose sensitive information on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the IO80211Family kernel extension. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges in the context of the kernel. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A security vulnerability exists in the Wi-Fi component of Apple macOS Catalina versions prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043 Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit) Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.3. A malicious application may be able to access restricted files. macOS Catalina Due to a flaw in the verification of symbolic links symlinks There is a processing verification vulnerability.Restricted files can be accessed through malicious applications. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. Crash Reporter is one of the error reporting components. A security vulnerability exists in the Crash Reporter component of Apple macOS Catalina prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043 Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit) Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=