Out-of-bounds read in iPadOS and Apple iOS - CVE-2020-29618
Published: December 15, 2020
Vulnerability identifier: #VU48990
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-29618
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a heap corruption within the ImageIO component when processing images. A remote attacker can create a specially crafted image, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.
Reportedly this vulnerability can lead to remote code execution.
Affected software
iPadOS
Apple iOS
watchOS
macOS
tvOS
iCloud for Windows
Apple iOS
watchOS
macOS
tvOS
iCloud for Windows
How to mitigate CVE-2020-29618
Install updates from vendor's website.
iPadOS - update to 14.3 18C66
Apple iOS - update to 14.3 18C66
watchOS - update to 7.2 18S564
macOS - addressed in versions 10.14.6 18G7016, 10.15.7 19H114, 11.1 20C69
tvOS - update to 14.3 18K561
iCloud for Windows - update to 12.0
Apple iOS - update to 14.3 18C66
watchOS - update to 7.2 18S564
macOS - addressed in versions 10.14.6 18G7016, 10.15.7 19H114, 11.1 20C69
tvOS - update to 14.3 18K561
iCloud for Windows - update to 12.0