Actively exploited in the wild
Apple Multiple Products Memory Corruption Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-27930
HighCVSS 7.8KEVSummary
A memory corruption issue was addressed with improved input validation. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. Processing a maliciously crafted font may lead to arbitrary code execution.
Risk Assessment
An attacker could exploit a malicious font to execute arbitrary code on the victim's device, potentially leading to system compromise. However, opening or processing a crafted font file is required.
Recommendation
Update Apple systems to the latest versions: macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006, iOS 14.2, iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update. Avoid opening unknown font files.
Other vulnerabilities in Apple macOS, iOS, iPadOS, watchOS
See all- CVE-2021-30807HighActively exploited
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2020-27932HighActively exploited
A type confusion issue was addressed with improved state handling. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. A malicious application may be able to execute arbitrary code with kernel privileges.
Original NVD description (English source)
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.