Actively exploited in the wild
Apple Multiple Products Type Confusion Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-27932
HighCVSS 7.8KEVSummary
A type confusion issue was addressed with improved state handling. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. A malicious application may be able to execute arbitrary code with kernel privileges.
Risk Assessment
A malicious application could exploit this vulnerability to execute code with kernel privileges, potentially leading to full device compromise. However, installation of a malicious application is required.
Recommendation
Update Apple systems to the latest versions: macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006, iOS 14.2, iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update. Avoid installing applications from unknown sources.
Other vulnerabilities in Apple macOS, iOS, iPadOS, watchOS
See all- CVE-2021-30807HighActively exploited
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2020-27930HighActively exploited
A memory corruption issue was addressed with improved input validation. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. Processing a maliciously crafted font may lead to arbitrary code execution.
Original NVD description (English source)
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to execute arbitrary code with kernel privileges.