CVE-2020-9859: Apple Multiple Products Code Execution Vulnerability

Q: What is CVE-2020-9859?

CVE-2020-9859 is a code execution vulnerability that allows an application to execute arbitrary code with kernel privileges in multiple Apple products.

Q: Which Apple products are affected by CVE-2020-9859?

CVE-2020-9859 affects multiple Apple products including iOS, iPadOS, macOS, tvOS, and watchOS.

Q: What is the severity of CVE-2020-9859?

The severity of CVE-2020-9859 is high, with a severity score of 7.8.

Q: How can I fix CVE-2020-9859?

To fix CVE-2020-9859, update to the latest versions of iOS, iPadOS, macOS, tvOS, and watchOS as mentioned in the Apple support articles.

Q: Where can I find more information about CVE-2020-9859?

You can find more information about CVE-2020-9859 on the official Apple support articles.

Published Jun 1, 2020

Updated

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.

Other sources

Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.

— CISA

Kernel. A memory consumption issue was addressed with improved memory handling.

Credit

unc0ver

Affected Software

12 affected componentsFixes available

Apple Multiple Products

Apple tvOS<13.4.6

13.4.6

Apple macOS Catalina Supplemental Update<10.15.5

10.15.5

Apple High Sierra

Apple WatchOS<6.2.6

6.2.6

Apple iOS<13.5.1

13.5.1

Apple iPadOS<13.5.1

13.5.1

Apple iPadOS<13.5.1

Apple iPhone OS<13.5.1

Apple iOS and macOS<10.15.5

Apple tvOS<13.4.6

Apple WatchOS<6.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 13.4.6
Upgrade
Upgrade Apple macOS Supplemental Update to a version that resolves this vulnerability.
Fixed in 10.15.5
Upgrade
Upgrade Apple iOS, iPadOS, and watchOS to a version that resolves this vulnerability.
Fixed in 6.2.6
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 13.5.1
Upgrade
Upgrade Apple iOS, iPadOS, and macOS to a version that resolves this vulnerability.
Fixed in 13.5.1
Upgrade
Upgrade Apple iOS to a version that resolves this vulnerability.
Fixed in 13.5.1
Upgrade
Upgrade Apple iPadOS to a version that resolves this vulnerability.
Fixed in 13.5.1
Upgrade
Upgrade macOS Catalina to a version that resolves this vulnerability.
Fixed in 10.15.5
Upgrade
Upgrade watchOS to a version that resolves this vulnerability.
Fixed in 6.2.6

Event History

Jun 5, 2020

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Nov 3, 2021

Known Exploited

via CISA·12:00 AM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2020-9859

Frequently Asked Questions

What is CVE-2020-9859?