The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation.

**Overview**"VIPRE Password Vault is the fast and easy way to securely manage all of your passwords without the hassle of writing them down or storing them on a spreadsheet. Whether you are logging into your favorite social media site, ordering the latest gadget from your favorite e-tailer, paying your bills online, or booking your vacation log in safely and securely using VIPRE’s new password manager."

(https://support.threattracksecurity.com/support/solutions/articles/1000104275-what-is-vipre-password-vault)

**Issue**The VIPRE Password Vault iOS application (version 1.100.1090 and below, later versions have not been tested), does not validate the SSL certificate it receives when connecting to the application login server.**Impact**An attacker who can perform a man in the middle attack may present a bogus SSL certificate which the application will accept silently. Sensitive information such as passwords could be captured by an attacker without the user's knowledge.**Timeline**July 18, 2015 - Attempted to notify ThreatTrack Security via security@vipreantivirus.com  
July 29, 2015 - Notified ThreatTrack Security via a contact form  
July 31, 2015 - ThreatTrack Security advised that the information has been routed to the proper team for remediation  
December 3, 2015 - Provided the details to CERT/CC  
April 3, 2016 - Provided the details to the Apple Product Security team  
June 22, 2020 - Published an advisory to document the issue  
**CVE-ID:**CVE-2020-14981**Questions?**Contact Information

**Info-Sec.CA**

CVE-2020-14981: VIPRE Password Vault iOS Application - MITM SSL Certificate Vulnerability (CVE-2020-14981)

Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.

CVE-2020-14929

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Percent-encoded cookies can be used to overwrite existing prefixed cookie names

It is possible to forge a secure or host-only cookie prefix in Rack using  
an arbitrary cookie write by using URL encoding (percent-encoding) on the  
name of the cookie. This could result in an application that is dependent on  
this prefix to determine if a cookie is safe to process being manipulated  
into processing an insecure or cross-origin request.  
This vulnerability has been assigned the CVE identifier CVE-2020-8184.

Versions Affected: rack < 2.2.3, rack < 2.1.4  
Not affected: Applications which do not rely on \_\_Host- and \_\_Secure- prefixes to determine if a cookie is safe to process  
Fixed Versions: rack >= 2.2.3, rack >= 2.1.4

Impact  
\------

An attacker may be able to trick a vulnerable application into processing an  
insecure (non-SSL) or cross-origin request if they can gain the ability to write  
arbitrary cookies that are sent to the application.

Releases  
\--------

The fixed releases are available on RubyGems.

Workarounds  
\-----------

If your application is impacted but you cannot upgrade to the released versions or apply  
the provided patch, this issue can be temporarily addressed by adding the following workaround:

module Rack  
module Utils  
module\_function def parse\_cookies\_header(header)  
return {} unless header  
header.split(/\[;\] \*/n).each\_with\_object({}) do |cookie, cookies|  
next if cookie.empty?  
key, value = cookie.split('=', 2)  
cookies\[key\] = (unescape(value) rescue value) unless cookies.key?(key)  
end  
end  
end  
end

Patches  
\-------

For developers who are not able to immediately upgrade their applications,  
we are including the following patches for Rack 2.1.3 and Rack 2.2.2:

\* 2-1-only-decode-cookie-values.patch  
\* 2-2-only-decode-cookie-values.patch

Credits  
\-------

Thank you to the GitHub security team and Matt Langlois (@fletchto99) for reporting this bug and  
providing a patch.

CVE-2020-8184: [CVE-2020-8184] Percent-encoded cookies can be used to overwrite existing prefixed cookie names

An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.

**CVE-2020-8618: A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer**

*   Updated on 17 Jun 2020
*   2 Minutes to read
*   Contributors
    

*   Print
    
*   Share
    
*   Dark
    
    Light
    

**CVE:** CVE-2020-8618

**Document version:** 2.0

**Posting date:** 17 June 2020

**Program impacted:** BIND

**Versions affected:** BIND 9.16.0 -> 9.16.3

**Severity:** Medium

**Exploitable:** Remotely

**Description:**

An assertion check in BIND (that is meant to prevent going beyond the end of a buffer when processing incoming data) can be incorrectly triggered by a large response during zone transfer.

**Impact:**

An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.

**CVSS Score:** 4.3

**CVSS Vector:** AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

For more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C&version=3.1.

**Workarounds:**

None

**Active exploits:**

We are not aware of any active exploits.

**Solution:**

Upgrade to the patched release most closely related to your current version of BIND:

*   BIND 9.16.4

**Document revision history:**

1.0 Early Notification, 10 June 2020  
1.1 Simplified "Exploitable" section, 17 June 2020  
2.0 Public disclosure, 17 June 2020

**Related documents:**

See our BIND 9 Security Vulnerability Matrix for a complete listing of security vulnerabilities and versions affected.

**Do you still have questions?** Questions regarding this advisory should go to security-officer@isc.org. _To report a new issue, please encrypt your message using security-officer@isc.org's PGP key which can be found here: https://www.isc.org/pgpkey/. If you are unable to use encrypted email, you may also report new issues at: https://www.isc.org/reportbug/._

**Note:**

ISC patches only currently supported versions. When possible we indicate EOL versions affected. (For current information on which versions are actively supported, please see https://www.isc.org/download/.)

**ISC Security Vulnerability Disclosure Policy:**

Details of our current security advisory policy and practice can be found in the ISC Software Defect and Security Vulnerability Disclosure Policy at https://kb.isc.org/docs/aa-00861.

The Knowledgebase article https://kb.isc.org/docs/cve-2020-8618 is the complete and official security advisory document.

**Legal Disclaimer:**

Internet Systems Consortium (ISC) is providing this notice on an "AS IS" basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. ISC expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects, or of non-infringement. Your use or reliance on this notice or materials referred to in this notice is at your own risk. ISC may change this notice at any time. A stand-alone copy or paraphrase of the text of this document that omits the document URL is an uncontrolled copy. Uncontrolled copies may lack important information, be out of date, or contain factual errors.

CVE-2020-8618: CVE-2020-8618: A buffer boundary check assertion in rdataset.c can fai

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

**CVE-2020-8619: An asterisk character in an empty non-terminal can cause an assertion failure in rbtdb.c**

*   Updated on 05 Aug 2021
*   3 Minutes to read
*   Contributors
    

*   Print
    
*   Share
    
*   Dark
    
    Light
    

**CVE:** CVE-2020-8619

**Document version:** 2.1

**Posting date:** 17 June 2020

**Program impacted:** BIND

**Versions affected:** BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3. Also, versions 9.11.14-S1 -> 9.11.19-S1 of BIND Supported Preview Edition

**Severity:** Medium

**Exploitable:** Remotely, but only if records matching a certain pattern are present in a zone being served.

**Description:**

The asterisk character ("\*") is allowed in DNS zone files, where it is most commonly present as a wildcard at a terminal node of the Domain Name System graph. However, the RFCs do not require and BIND does not enforce that an asterisk character be present only at a terminal node.

A problem can occur when an asterisk is present in an empty non-terminal location within the DNS graph. If such a node exists, after a series of queries, named can reach an inconsistent state that results in the failure of an assertion check in rbtdb.c, followed by the program exiting due to the assertion failure.

**Impact:**

Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("\*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

**CVSS Score:** 4.3

**CVSS Vector:** AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

For more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C&version=3.1.

**Workarounds:**

None

**Active exploits:**

We are not aware of any active exploits.

**Solution:**

Upgrade to the patched release most closely related to your current version of BIND:

*   BIND 9.11.20
*   BIND 9.16.4

BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.

*   BIND 9.11.20-S1

**Document revision history:**

1.0 Early Notification, 10 June 2020  
1.1 Corrected "Versions affected" to list Supported Preview Edition releases, 17 June 2020  
2.0 Public disclosure, 17 June 2020  
2.1 Fixed broken link, 5 August 2021

**Related documents:**

See our BIND 9 Security Vulnerability Matrix for a complete listing of security vulnerabilities and versions affected.

**Do you still have questions?** Questions regarding this advisory should go to security-officer@isc.org. _To report a new issue, please encrypt your message using security-officer@isc.org's PGP key which can be found here: https://www.isc.org/pgpkey/. If you are unable to use encrypted email, you may also report new issues at: https://www.isc.org/reportbug/._

**Note:**

ISC patches only currently supported versions. When possible we indicate EOL versions affected. (For current information on which versions are actively supported, please see https://www.isc.org/download/.)

**ISC Security Vulnerability Disclosure Policy:**

Details of our current security advisory policy and practice can be found in the ISC Software Defect and Security Vulnerability Disclosure Policy at https://kb.isc.org/docs/aa-00861.

The Knowledgebase article https://kb.isc.org/docs/cve-2020-8619 is the complete and official security advisory document.

**Legal Disclaimer:**

Internet Systems Consortium (ISC) is providing this notice on an "AS IS" basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. ISC expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects, or of non-infringement. Your use or reliance on this notice or materials referred to in this notice is at your own risk. ISC may change this notice at any time. A stand-alone copy or paraphrase of the text of this document that omits the document URL is an uncontrolled copy. Uncontrolled copies may lack important information, be out of date, or contain factual errors.

CVE-2020-8619: CVE-2020-8619: An asterisk character in an empty non-terminal can caus

The Server-Server protocol implementation in ngIRCd before 26~rc2 allows an out-of-bounds access, as demonstrated by the IRC_NJOIN() function.

**ngIRCd 26~rc2 (2020-06-11)**

The ChangeLog lists the following changes since ngIRCd 26~rc1:

*   Add AppStream metadata file (contrib/de.barton.ngircd.metainfo.xml).
    
*   Don't send invalid CHANINFO commands when a channel has mode +k set but no key is known to the server. This can happen with a misconfigured predefined channel, for example, and looked like this:
    
    Note the unset key represented by the two spaces. Fix this by sending a * in this case and update the CHANINFO documentation, too.
    
*   ngircd.spec: Fix names of README.md and INSTALL.md, add .md extension.
    
*   Update description texts in the README.md file, the RPM and Debian package files and the manual page: bring them in line with the updated homepage.
    
*   Server-Server protocol: Fix use-after-free when unregistering a directly connected server sending a SQUIT for itself.
    
*   Server-Server protocol: Detect bogus SERVER commands lacking a prefix. Thanks Hilko Bengen (hillu) for finding & reporting this as well for the patch & pull request (even if fixed differently).  
    Closes #275.
    
*   Fix the PING\-PONG logic: In ngIRCd 26~rc1 this was completely broken (while trying to fix timeouts during server handshakes in bigger networks): the daemon never disconnected any stale peers but kept sending out PINGs over and over again ...
    
*   Test suite: Add missing files needed to test SSL support to EXTRA_DIST, so that they are included in distribution archives: in rc1, "make check" fails when using sources from an archive and enabling SSL support. Thanks to Hilko Bengen bengen@hilluzination.de for the patch!

CVE-2020-14148: Release ngIRCd 26~rc2 · ngircd/ngircd

Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.

**Kevin J. McCarthy** kevin at 8t8.us  
_Sun Jun 14 22:05:29 UTC 2020_

*   **Messages sorted by:** \[ date \] \[ thread \] \[ subject \] \[ author \]

Hello Mutt Users,

I've just released version 1.14.3.  Instructions for downloading are 
available at <http://www.mutt.org/download.html\>, or the tarball can be 
directly downloaded from <http://ftp.mutt.org/pub/mutt/\>.  Please take 
the time to verify the signature file against my public key.

This is an important security release fixing two issues.

The first is a possible IMAP man-in-the-middle attack.  No credentials 
are exposed, but could result in unintended emails being "saved" to an 
attacker's server.  The $ssl\_starttls quadoption is now used to check 
for an unencrypted PREAUTH response from the server.

Thanks very much to Damian Poddebniak and Fabian Ising from the Münster 
University of Applied Sciences for reporting this issue, and their help 
in testing the fix.

The second fix is for a problem with GnuTLS certificate prompting. 
"Rejecting" an expired intermediate cert did not terminate the 
connection.  Thanks to @henk on IRC for reporting the issue.

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.mutt.org/pipermail/mutt-announce/attachments/20200614/b31d9198/attachment.asc\>

*   **Messages sorted by:** \[ date \] \[ thread \] \[ subject \] \[ author \]

More information about the Mutt-announce mailing list

CVE-2020-14154: mutt 1.14.3 released

A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to gain root privileges.

Released May 26, 2020

**Accounts**

Available for: macOS Catalina 10.15.4

Impact: A remote attacker may be able to cause a denial of service

Description: A denial of service issue was addressed with improved input validation.

CVE-2020-9827: Jannik Lorenz of SEEMOO @ TU Darmstadt

**Accounts**

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9772: Allison Husain of UC Berkeley

**AirDrop**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A remote attacker may be able to cause a denial of service

Description: A denial of service issue was addressed with improved input validation.

CVE-2020-9826: Dor Hadad of Palo Alto Networks

**AppleMobileFileIntegrity**

Available for: macOS High Sierra 10.13.6, macOS Catalina 10.15.4

Impact: A malicious application could interact with system processes to access private information and perform privileged actions

Description: An entitlement parsing issue was addressed with improved parsing.

CVE-2020-9842: Linus Henze (pinauten.de)

**AppleUSBNetworking**

Available for: macOS Catalina 10.15.4

Impact: Inserting a USB device that sends invalid messages may cause a kernel panic

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9804: Andy Davis of NCC Group

**Audio**

Available for: macOS Catalina 10.15.4

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9815: Yu Zhou (@yuzhou6666) working with Trend Micro Zero Day Initiative

**Audio**

Available for: macOS Catalina 10.15.4

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9791: Yu Zhou (@yuzhou6666) working with Trend Micro Zero Day Initiative

**Bluetooth**

Available for: macOS Catalina 10.15.4

Impact: A malicious application may be able to determine kernel memory layout

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9831: Yu Wang of Didi Research America

**Bluetooth**

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9779: Yu Wang of Didi Research America

Entry added September 21, 2020

**Calendar**

Available for: macOS Catalina 10.15.4

Impact: Importing a maliciously crafted calendar invitation may exfiltrate user information

Description: This issue was addressed with improved checks.

CVE-2020-3882: Andy Grant of NCC Group

**CoreBluetooth**

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6

Impact: A remote attacker may be able to leak sensitive user information

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9828: Jianjun Dai of Qihoo 360 Alpha Lab

**CVMS**

Available for: macOS Catalina 10.15.4

Impact: An application may be able to gain elevated privileges

Description: This issue was addressed with improved checks.

CVE-2020-9856: @jinmo123, @setuid0x0\_, and @insu\_yun\_en of @SSLab\_Gatech working with Trend Micro’s Zero Day Initiative

**DiskArbitration**

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.4

Impact: A malicious application may be able to break out of its sandbox

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9847: Zhuo Liang of Qihoo 360 Vulcan Team working with 360 BugCloud (bugcloud.360.cn)

**Find My**

Available for: macOS Catalina 10.15.4

Impact: A local attacker may be able to elevate their privileges

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2020-9855: Zhongcheng Li(CK01) of Topsec Alpha Team

**FontParser**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9816:  Peter Nguyen Vu Hoang of STAR Labs working with Trend Micro Zero Day Initiative

**ImageIO**

Available for: macOS Catalina 10.15.4

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3878: Samuel Groß of Google Project Zero

**ImageIO**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9789: Wenchao Li of VARAS@IIE

CVE-2020-9790: Xingwei Lin of Ant-financial Light-Year Security Lab

**Intel Graphics Driver**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9822: ABC Research s.r.o

**Intel Graphics Driver**

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A race condition was addressed with improved state handling.

CVE-2020-9796: ABC Research s.r.o.

Entry added July 28, 2020

**IPSec**

Available for: macOS High Sierra 10.13.6, macOS Catalina 10.15.4

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9837: Thijs Alkemade of Computest

**Kernel**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9821: Xinru Chi and Tielei Wang of Pangu Lab

**Kernel**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A malicious application may be able to determine another application's memory layout

Description: An information disclosure issue was addressed by removing the vulnerable code.

CVE-2020-9797: an anonymous researcher

**Kernel**

Available for: macOS Catalina 10.15.4

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: An integer overflow was addressed with improved input validation.

CVE-2020-9852: Tao Huang and Tielei Wang of Pangu Lab

**Kernel**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A use after free issue was addressed with improved memory management.

CVE-2020-9795: Zhuo Liang of Qihoo 360 Vulcan Team

**Kernel**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: An application may be able to cause unexpected system termination or write kernel memory

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9808: Xinru Chi and Tielei Wang of Pangu Lab

**Kernel**

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.4

Impact: A local user may be able to read kernel memory

Description: An information disclosure issue was addressed with improved state management.

CVE-2020-9811: Tielei Wang of Pangu Lab

CVE-2020-9812: derrek (@derrekr6)

**Kernel**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management.

CVE-2020-9813: Xinru Chi of Pangu Lab

CVE-2020-9814: Xinru Chi and Tielei Wang of Pangu Lab

**Kernel**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A malicious application may be able to determine kernel memory layout

Description: An information disclosure issue was addressed with improved state management.

CVE-2020-9809: Benjamin Randazzo (@\_\_\_\_benjamin)

**ksh**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A local user may be able to execute arbitrary shell commands

Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation.

CVE-2019-14868

**libxpc**

Available for: macOS Catalina 10.15.4

Impact: A malicious application may be able to overwrite arbitrary files

Description: A path handling issue was addressed with improved validation.

CVE-2020-9994: Apple

Entry added September 21, 2020

**NSURL**

Available for: macOS Mojave 10.14.6

Impact: A malicious website may be able to exfiltrate autofilled data in Safari

Description: An issue existed in the parsing of URLs. This issue was addressed with improved input validation.

CVE-2020-9857: Dlive of Tencent Security Xuanwu Lab

**PackageKit**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A malicious application may be able to gain root privileges

Description: A permissions issue existed. This issue was addressed with improved permission validation.

CVE-2020-9817: Andy Grant of NCC Group

**PackageKit**

Available for: macOS Catalina 10.15.4

Impact: A malicious application may be able to modify protected parts of the file system

Description: An access issue was addressed with improved access restrictions.

CVE-2020-9851: an anonymous researcher, Linus Henze (pinauten.de)

Entry updated July 15, 2020

**Python**

Available for: macOS Catalina 10.15.4

Impact: A remote attacker may be able to cause arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-9793

**rsync**

Available for: macOS Catalina 10.15.4

Impact: A remote attacker may be able to overwrite existing files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2014-9512: gaojianfeng

Entry added July 28, 2020

**Sandbox**

Available for: macOS Catalina 10.15.4

Impact: A malicious application may be able to bypass Privacy preferences

Description: An access issue was addressed with additional sandbox restrictions.

CVE-2020-9825: Sreejith Krishnan R (@skr0x1C0)

**Sandbox**

Available for: macOS Mojave 10.14.6

Impact: A user may gain access to protected parts of the file system

Description: This issue was addressed with a new entitlement.

CVE-2020-9771: Csaba Fitzl (@theevilbit) of Offensive Security

**Security**

Available for: macOS Catalina 10.15.4

Impact: A file may be incorrectly rendered to execute JavaScript

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-9788: Wojciech Reguła of SecuRing (wojciechregula.blog)

Entry updated July 15, 2020

**Security**

Available for: macOS Catalina 10.15.4

Impact: An application may be able to gain elevated privileges

Description: A logic issue was addressed with improved validation.

CVE-2020-9854: Ilias Morad (A2nkF)

Entry added July 28, 2020

**SIP**

Available for: macOS Catalina 10.15.4

Impact: A non-privileged user may be able to modify restricted network settings

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9824: @jamestraynor, Csaba Fitzl (@theevilbit) of Offensive Security

Entry updated June 10, 2020

**Software Update**

Available for: macOS Catalina 10.15.4

Impact: A person with physical access to a Mac may be able to bypass Login Window

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9810: Francis @francisschmaltz

Entry added July 15, 2020

**SQLite**

Available for: macOS Catalina 10.15.4

Impact: A malicious application may cause a denial of service or potentially disclose memory contents

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9794

**System Preferences**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: An application may be able to gain elevated privileges

Description: A race condition was addressed with improved state handling.

CVE-2020-9839: @jinmo123, @setuid0x0\_, and @insu\_yun\_en of @SSLab\_Gatech working with Trend Micro’s Zero Day Initiative

**USB Audio**

Available for: macOS Catalina 10.15.4

Impact: A USB device may be able to cause a denial of service

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-9792: Andy Davis of NCC Group

**Wi-Fi**

Available for: macOS Catalina 10.15.4

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: A double free issue was addressed with improved memory management.

CVE-2020-9844: Ian Beer of Google Project Zero

**Wi-Fi**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9830: Tielei Wang of Pangu Lab

**Wi-Fi**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-9834: Yu Wang of Didi Research America

**Wi-Fi**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A local user may be able to read kernel memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2020-9833: Yu Wang of Didi Research America

**Wi-Fi**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A malicious application may be able to determine kernel memory layout

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9832: Yu Wang of Didi Research America

**WindowServer**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: An integer overflow was addressed with improved input validation.

CVE-2020-9841: ABC Research s.r.o. working with Trend Micro Zero Day Initiative

**zsh**

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.4

Impact: A local attacker may be able to elevate their privileges

Description: An authorization issue was addressed with improved state management.

CVE-2019-20044: Sam Foxman

CVE-2020-9817: About the security content of macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra

A race condition was addressed with improved state handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. An application may be able to gain elevated privileges.

Released May 20, 2020

**Accounts**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause a denial of service

Description: A denial of service issue was addressed with improved input validation.

CVE-2020-9827: Jannik Lorenz of SEEMOO @ TU Darmstadt

**AirDrop**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause a denial of service

Description: A denial of service issue was addressed with improved input validation.

CVE-2020-9826: Dor Hadad of Palo Alto Networks

**AppleMobileFileIntegrity**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application could interact with system processes to access private information and perform privileged actions

Description: An entitlement parsing issue was addressed with improved parsing.

CVE-2020-9842: Linus Henze (pinauten.de)

**Audio**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9815: Yu Zhou (@yuzhou6666) working with Trend Micro Zero Day Initiative

**Audio**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9791: Yu Zhou (@yuzhou6666) working with Trend Micro Zero Day Initiative

**Bluetooth**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic

Description: An issue existed with the use of a PRNG with low entropy. This issue was addressed with improved state management.

CVE-2020-6616: Jörn Tillmanns (@matedealer) and Jiska Classen (@naehrdine) of Secure Mobile Networking Lab

**Bluetooth**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9838: Dennis Heinze (@ttdennis) of TU Darmstadt, Secure Mobile Networking Lab

**CoreText**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted text message may lead to application denial of service

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-9829: Aaron Perris (@aaronp613), an anonymous researcher, an anonymous researcher, Carlos S Tech, Sam Menzies of Sam’s Lounge, Sufiyan Gouri of Lovely Professional University, India, Suleman Hasan Rathor of Arabic-Classroom.com

**FaceTime**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A user’s video may not be paused in a FaceTime call if they exit the FaceTime app while the call is ringing

Description: An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic.

CVE-2020-9835: Olivier Levesque (@olilevesque)

**File System**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to modify the file system

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9820: Thijs Alkemade of Computest

**FontParser**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9816:  Peter Nguyen Vu Hoang of STAR Labs working with Trend Micro Zero Day Initiative

**ImageIO**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3878: Samuel Groß of Google Project Zero

**ImageIO**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9789: Wenchao Li of VARAS@IIE

CVE-2020-9790: Xingwei Lin of Ant-financial Light-Year Security Lab

**IPSec**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9837: Thijs Alkemade of Computest

**Kernel**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9821: Xinru Chi and Tielei Wang of Pangu Lab

**Kernel**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to determine another application's memory layout

Description: An information disclosure issue was addressed by removing the vulnerable code.

CVE-2020-9797: an anonymous researcher

**Kernel**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: An integer overflow was addressed through improved input validation.

CVE-2020-9852: Tao Huang and Tielei Wang of Pangu Lab

**Kernel**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A use after free issue was addressed with improved memory management.

CVE-2020-9795: Zhuo Liang of Qihoo 360 Vulcan Team

**Kernel**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to cause unexpected system termination or write kernel memory

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9808: Xinru Chi and Tielei Wang of Pangu Lab

**Kernel**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A local user may be able to read kernel memory

Description: An information disclosure issue was addressed with improved state management.

CVE-2020-9811: Tielei Wang of Pangu Lab

CVE-2020-9812: derrek (@derrekr6)

**Kernel**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management.

CVE-2020-9813: Xinru Chi of Pangu Lab

CVE-2020-9814: Xinru Chi and Tielei Wang of Pangu Lab

**Kernel**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to determine kernel memory layout

Description: An information disclosure issue was addressed with improved state management.

CVE-2020-9809: Benjamin Randazzo (@\_\_\_\_benjamin)

**libxpc**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to overwrite arbitrary files

Description: A path handling issue was addressed with improved validation.

CVE-2020-9994: Apple

Entry added September 21, 2020

**Mail**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted mail message may lead to heap corruption

Description: A memory consumption issue was addressed with improved memory handling.

CVE-2020-9819: ZecOps.com

**Mail**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9818: ZecOps.com

**Messages**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Users removed from an iMessage conversation may still be able to alter state

Description: This issue was addressed with improved checks.

CVE-2020-9823: Suryansh Mansharamani, student of Community Middle School, Plainsboro, New Jersey

**Notifications**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A person with physical access to an iOS device may be able to view notification contents from the lockscreen

Description: An authorization issue was addressed with improved state management.

CVE-2020-9848: Nima

**rsync**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to overwrite existing files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2014-9512: gaojianfeng

Entry added July 28, 2020

**Sandbox**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to bypass Privacy preferences

Description: An access issue was addressed with additional sandbox restrictions.

CVE-2020-9825: Sreejith Krishnan R (@skr0x1C0)

**Security**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to gain elevated privileges

Description: A logic issue was addressed with improved validation.

CVE-2020-9854: Ilias Morad (A2nkF)

Entry added July 28, 2020

**SQLite**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may cause a denial of service or potentially disclose memory contents

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9794

**System Preferences**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to gain elevated privileges

Description: A race condition was addressed with improved state handling.

CVE-2020-9839: @jinmo123, @setuid0x0\_, and @insu\_yun\_en of @SSLab\_Gatech working with Trend Micro’s Zero Day Initiative

**USB Audio**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A USB device may be able to cause a denial of service

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-9792: Andy Davis of NCC Group

**WebKit**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9805: an anonymous researcher

**WebKit**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9802: Samuel Groß of Google Project Zero

**WebKit**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause arbitrary code execution

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9850: @jinmo123, @setuid0x0\_, and @insu\_yun\_en of @SSLab\_Gatech working with Trend Micro’s Zero Day Initiative

**WebKit**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may lead to a cross site scripting attack

Description: An input validation issue was addressed with improved input validation.

CVE-2020-9843: Ryan Pickren (ryanpickren.com)

**WebKit**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved validation.

CVE-2020-9803: Wen Xu of SSLab at Georgia Tech

**WebKit**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9806: Wen Xu of SSLab at Georgia Tech

CVE-2020-9807: Wen Xu of SSLab at Georgia Tech

**WebKit**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A type confusion issue was addressed with improved memory handling.

CVE-2020-9800: Brendan Draper (@6r3nd4n) working with Trend Micro Zero Day Initiative

**WebRTC**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may result in the disclosure of process memory

Description: An access issue was addressed with improved memory management.

CVE-2019-20503: natashenka of Google Project Zero

**Wi-Fi**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: A double free issue was addressed with improved memory management.

CVE-2020-9844: Ian Beer of Google Project Zero

**Wi-Fi**

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9830: Tielei Wang of Pangu Lab

Entry added August 10, 2020

CVE-2020-9839: About the security content of iOS 13.5 and iPadOS 13.5

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Tag

#ssl