CVE-2020-27912 : An out-of-bounds write was addressed with improved input validation. This issue

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. Processing a maliciously crafted image may lead to arbitrary code execution.

Published 2020-12-08 21:15:13

Updated 2021-03-10 14:54:27

Source Apple Inc.

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2020-27912

Apple » Itunes » For Windows
Versions before (<) 12.11
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
Matching versions
Apple » Iphone Os
Versions before (<) 14.2
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Matching versions
Apple » Watchos
Versions before (<) 7.1
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Matching versions
Apple » Icloud » For Windows
Versions before (<) 11.5
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
Matching versions
Apple » Tvos
Versions before (<) 14.2
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Matching versions
Apple » Macos
Versions before (<) 11.0.1
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Matching versions
Apple » Ipados
Versions before (<) 14.2
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-27912

Top countries where our scanners detected CVE-2020-27912

Top open port discovered on systems with this issue 3689

IPs affected by CVE-2020-27912 323

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-27912!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-27912

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-27912

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-27912

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-27912

http://seclists.org/fulldisclosure/2020/Dec/32

Full Disclosure: APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1
Mailing List;Third Party Advisory

CVEs referencing this url
https://support.apple.com/en-us/HT211935

Vendor Advisory

CVEs referencing this url
https://support.apple.com/en-us/HT211929

Vendor Advisory

CVEs referencing this url
https://support.apple.com/kb/HT212011

About the security content of macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave - Apple Support
Vendor Advisory

CVEs referencing this url
https://support.apple.com/en-us/HT211930

Vendor Advisory

CVEs referencing this url
https://support.apple.com/en-us/HT211931

Vendor Advisory

CVEs referencing this url
https://support.apple.com/en-us/HT211933

Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2020/Dec/26

Full Disclosure: APPLE-SA-2020-12-14-3 macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave
Mailing List;Third Party Advisory

CVEs referencing this url
https://support.apple.com/en-us/HT211928

Vendor Advisory

CVEs referencing this url