what you don't know can hurt you

Apple Security Advisory 2020-1-28-2

Apple Security Advisory 2020-1-28-2
Posted Jan 29, 2020
Authored by Apple | Site apple.com

Apple Security Advisory 2020-1-28-2 - macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address buffer overflow, bypass, and code execution vulnerabilities.

tags | advisory, overflow, vulnerability, code execution
systems | apple
advisories | CVE-2019-11043, CVE-2019-18634, CVE-2020-3826, CVE-2020-3827, CVE-2020-3829, CVE-2020-3830, CVE-2020-3835, CVE-2020-3836, CVE-2020-3837, CVE-2020-3838, CVE-2020-3839, CVE-2020-3840, CVE-2020-3842, CVE-2020-3843, CVE-2020-3845, CVE-2020-3846, CVE-2020-3847, CVE-2020-3848, CVE-2020-3849, CVE-2020-3850, CVE-2020-3853, CVE-2020-3854, CVE-2020-3855, CVE-2020-3856, CVE-2020-3857, CVE-2020-3866, CVE-2020-3870, CVE-2020-3871
MD5 | b7ed3a864bedd652761c597b31e522a1

Apple Security Advisory 2020-1-28-2

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update
2020-001 Mojave, Security Update 2020-001 High Sierra

macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and
Security Update 2020-001 High Sierra are now available and
address the following:

AnnotationKit
Available for: macOS Catalina 10.15.2
Impact: A remote attacker may be able to cause unexpected application
termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2020-3877: an anonymous researcher working with Trend Micro's
Zero Day Initiative

apache_mod_php
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: Multiple issues in PHP
Description: Multiple issues were addressed by updating to PHP
version 7.3.11.
CVE-2019-11043

Audio
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team

autofs
Available for: macOS Catalina 10.15.2
Impact: Searching for and opening a file from an attacker controlled
NFS mount may bypass Gatekeeper
Description: This was addressed with additional checks by Gatekeeper
on files mounted through a network share.
CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka
(@rene_kroka)

CoreBluetooth
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6
Impact: A remote attacker may be able to cause unexpected application
termination or arbitrary code execution
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab
CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab
CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab

CoreBluetooth
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab

Crash Reporter
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: A malicious application may be able to access restricted
files
Description: A validation issue existed in the handling of symlinks.
This issue was addressed with improved validation of symlinks.
CVE-2020-3835: Csaba Fitzl (@theevilbit)

Image Processing
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary
code execution
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2020-3827: Samuel Groß of Google Project Zero

ImageIO
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2020-3826: Samuel Groß of Google Project Zero
CVE-2020-3870
CVE-2020-3878: Samuel Groß of Google Project Zero

Intel Graphics Driver
Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team

IOAcceleratorFamily
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3837: Brandon Azad of Google Project Zero

IPSec
Available for: macOS Catalina 10.15.2
Impact: Loading a maliciously crafted racoon configuration file may
lead to arbitrary code execution
Description: An off by one issue existed in the handling of racoon
configuration files. This issue was addressed through improved bounds
checking.
CVE-2020-3840: @littlelailo

Kernel
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2020-3875: Brandon Azad of Google Project Zero

Kernel
Available for: macOS Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of
Cognite

Kernel
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2020-3853: Brandon Azad of Google Project Zero

Kernel
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: A malicious application may be able to determine kernel
memory layout
Description: An access issue was addressed with improved memory
management.
CVE-2020-3836: Brandon Azad of Google Project Zero

Kernel
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3842: Ned Williamson working with Google Project Zero
CVE-2020-3871: Corellium

libxml2
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6
Impact: Processing maliciously crafted XML may lead to an unexpected
application termination or arbitrary code execution
Description: A buffer overflow was addressed with improved size
validation.
CVE-2020-3846: Ranier Vilela

libxpc
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: Processing a maliciously crafted string may lead to heap
corruption
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2020-3856: Ian Beer of Google Project Zero

libxpc
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: An application may be able to gain elevated privileges
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2020-3829: Ian Beer of Google Project Zero

PackageKit
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: A malicious application may be able to overwrite arbitrary
files
Description: A validation issue existed in the handling of symlinks.
This issue was addressed with improved validation of symlinks.
CVE-2020-3830: Csaba Fitzl (@theevilbit)

Security
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger
of the Security in Distributed Systems Group of University of Hamburg

sudo
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: Certain configurations may allow a local attacker to execute
arbitrary code
Description: A buffer overflow issue was addressed with improved
memory handling.
CVE-2019-18634: Apple

System
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6
Impact: A malicious application may be able to overwrite arbitrary
files
Description: An access issue was addressed with improved access
restrictions.
CVE-2020-3855: Csaba Fitzl (@theevilbit)

Wi-Fi
Available for: macOS Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National
University working with Trend Micro's Zero Day Initiative

Wi-Fi
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2020-3843: Ian Beer of Google Project Zero

wifivelocityd
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS
Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with
system privileges
Description: The issue was addressed with improved permissions logic.
CVE-2020-3838: Dayton Pidhirney (@_watbulb)

Additional recognition

Photos Storage
We would like to acknowledge Salman Husain of UC Berkeley for their
assistance.

Installation note:

macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and
Security Update 2020-001 High Sierra may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y
0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ
hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU
GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv
yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M
35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c
8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen
GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf
2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz
TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p
iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT
1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w=
=toYN
-----END PGP SIGNATURE-----=

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    20 Files
  • 3
    Apr 3rd
    10 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    0 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    0 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close