CVE-2020-36521: Input Validation
First published: Wed Sep 16 2020(Updated: )
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows 11.4, iOS 14.0 and iPadOS 14.0, watchOS 7.0, tvOS 14.0, iCloud for Windows 7.21, iTunes for Windows 12.10.9. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents.
Credit: Xingwei Lin AntXingwei Lin AntXingwei Lin AntXingwei Lin AntXingwei Lin AntXingwei Lin Ant product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iCloud for Windows | <7.21 | 7.21 |
| Apple iTunes for Windows | <12.10.9 | 12.10.9 |
| Apple iCloud for Windows | <11.4 | 11.4 |
| Apple watchOS | <7.0 | 7.0 |
| Apple tvOS | <14.0 | 14.0 |
| Apple iOS | <14.0 | 14.0 |
| Apple iPadOS | <14.0 | 14.0 |
| Apple Icloud Windows | <7.21 | |
| Apple Icloud Windows | >=11.0<11.4 | |
| Apple Itunes Windows | <12.10.9 | |
| Apple iPadOS | <14.0 | |
| Apple iPhone OS | <14.0 | |
| Apple macOS | <10.15.7 | |
| Apple tvOS | <14.0 | |
| Apple watchOS | <7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT211843 (Advisory)
- https://support.apple.com/en-us/HT211844 (Advisory)
- https://support.apple.com/en-us/HT211846 (Advisory)
- https://support.apple.com/en-us/HT211847 (Advisory)
- https://support.apple.com/en-us/HT211850 (Advisory)
- https://support.apple.com/en-us/HT211952 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2020-36521
- CVE-2020-9991
- CVE-2020-15358
- CVE-2020-9952
- CVE-2020-9999
- CVE-2020-9961
- CVE-2020-9876
- CVE-2020-9981
- CVE-2020-13434
- CVE-2020-13435
- CVE-2020-13630
- CVE-2020-13631
- CVE-2020-9849
- CVE-2020-9947
- CVE-2020-9951
- CVE-2020-9983
- CVE-2020-9943
- CVE-2020-9944
- CVE-2020-9960
- CVE-2020-9954
- CVE-2020-9949
- CVE-2020-9965
- CVE-2020-9966
- CVE-2020-29629
- CVE-2020-9956
- CVE-2020-9962
- CVE-2020-27931
- CVE-2020-29639
- CVE-2020-9978
- CVE-2020-9955
- CVE-2020-9967
- CVE-2020-9975
- CVE-2020-9976
- CVE-2020-9971
- CVE-2020-9941
- CVE-2020-9989
- CVE-2020-9946
- CVE-2020-9993
- CVE-2020-9969
- CVE-2020-9968
- CVE-2020-9950
- CVE-2020-9979
- CVE-2020-10013
- CVE-2020-9958
- CVE-2020-9773
- CVE-2020-9992
- CVE-2020-9964
- CVE-2019-14899
- CVE-2020-9988
- CVE-2020-13520
- CVE-2020-6147
- CVE-2020-9972
- CVE-2020-9973
- CVE-2020-9996
- CVE-2020-9963
- CVE-2020-9977
- CVE-2020-9959
Frequently Asked Questions
What is CVE-2020-36521?
CVE-2020-36521 is a vulnerability in ImageIO that allows an attacker to read out-of-bounds memory due to improved input validation.
Which software versions are affected by CVE-2020-36521?
CVE-2020-36521 affects Apple tvOS up to version 14.0, Apple iOS up to version 14.0, Apple iPadOS up to version 14.0, Apple watchOS up to version 7.0, Apple iTunes for Windows up to version 12.10.9, and Apple iCloud for Windows up to version 11.4 and 7.21.
What is the severity level of CVE-2020-36521?
The severity of CVE-2020-36521 is not specified.
How can I mitigate CVE-2020-36521?
To mitigate CVE-2020-36521, update your software to the latest version provided by Apple.
Where can I find more information about CVE-2020-36521?
You can find more information about CVE-2020-36521 on the Apple support website using the provided references.
- collector/apple-support
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/software-canonical-lookup-request
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/event
- agent/description
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/apple
- canonical/apple icloud for windows
- canonical/apple itunes for windows
- canonical/apple watchos
- canonical/apple tvos
- canonical/apple ios
- canonical/apple ipados
- canonical/apple icloud windows
- version/apple icloud windows/11.0
- canonical/apple itunes windows
- canonical/apple iphone os
- canonical/apple macos