Apple iOS

CVE-2020-3909

CRITICAL 9.8

At a glance

Source: NVD
EPSS: EPSS 3.04 % · percentile 87 (2026-10-30)
State: PUBLISHED
Published: 2020-04-01 17:53 UTC
Updated: 2024-08-04 07:52 UTC
Assigner: apple
NVD status: Modified

Search on…

Description

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Multiple issues in libxml2.

Weaknesses (CWE)

CWE-120 — Buffer Copy without Checking Size of Input

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2020-25174
GCVE · GCVE-0-2020-3909

CERT-FR advisories

CERTFR-2020-AVI-665 — Multiples vulnérabilités dans Oracle Systems · cert.ssi.gouv.fr
CERTFR-2020-AVI-171 — Multiples vulnérabilités dans Apple iCloud pour Windows · cert.ssi.gouv.fr
CERTFR-2020-AVI-170 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* < 7.18
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* ≥ 10.9 < 10.9.3
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* < 12.10.5
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* < 13.4
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* < 13.4
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* < 10.15.4
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* < 13.4
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* < 6.2
cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit_software:8.8:*:*:*:*:*:*:*

Affected products

Product	Versions
Apple · iOS	affected unspecified < iOS 13.4 and iPadOS 13.4
Apple · macOS	affected unspecified < macOS Catalina 10.15.4
Apple · tvOS	affected unspecified < tvOS 13.4
Apple · watchOS	affected unspecified < watchOS 6.2
Apple · iTunes for Windows	affected unspecified < iTunes for Windows 12.10.5
Apple · iCloud for Windows	affected unspecified < iCloud for Windows 10.9.3
Apple · iCloud for Windows (Legacy)	affected unspecified < iCloud for Windows 7.18

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Apple iOS