CVE-2020-9934

Apple iOS, iPadOS, and macOS: Input Validation

As of , CVE-2020-9934 in Apple iOS, iPadOS, and macOS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 8 September 2022
US federal deadline
29 September 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.03Higher than 87% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.02 on 8 September 2022EPSS on the day CISA listed it.
Public exploit
1 Metasploit module
Fix
Vendor advice: support.apple.comLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.

CISA's description

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

The CVE record's description, from apple

CVE published
16 October 2020
Assigned by
apple
CVSS
5.5 Medium (CVSS 3.1, from CISA-ADP)
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
partial

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: Bypass the macOS TCC Frameworkpost module, rank normal

iOS, iPadOS, and macOS: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2023-41064ImageIO Buffer OverflowApple iOS, iPadOS, and macOSPatch this weekEPSS 0.530.53
CVE-2025-43300Out-of-Bounds WriteApple iOS, iPadOS, and macOSPatch soon0.32
CVE-2023-28206IOSurfaceAccelerator Out-of-Bounds WriteApple iOS, iPadOS, and macOSPatch soon0.23
CVE-2022-22620Webkit Use-After-FreeApple iOS, iPadOS, and macOSPatch soon0.16
CVE-2021-30858iOS, iPadOS, macOS Use-After-FreeApple iOS, iPadOS, and macOSPatch soon0.13
CVE-2021-1870WebKit Remote Code ExecutionApple iOS, iPadOS, and macOSPatch soon0.08
CVE-2021-1871WebKit Remote Code ExecutionApple iOS, iPadOS, and macOSPatch soon0.07
CVE-2021-30900Out-of-Bounds WriteApple iOS, iPadOS, and macOSPatch soon0.05
CVE-2022-32917Remote Code ExecutionApple iOS, iPadOS, and macOSPatch soon0.06
CVE-2021-30869Type ConfusionApple iOS, iPadOS, and macOSPatch soon0.04

Read further