CVSS: 5.5EPSS: 0%CPEs: 18EXPL: 1CVE-2020-15358 – sqlite: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization in select.c
https://notcve.org/view.php?id=CVE-2020-15358
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. En SQLite versiones anteriores a 3.32.3, el archivo select.c maneja inapropiadamente la optimización query-flattener, conllevando a un desbordamiento de la pila de multiSelectOrderBy debido al uso inapropiado de las propiedades transitivas para la propagación constante A heap buffer overflow was found in SQLite in the query flattening optimization technique. This flaw allows an attacker to execute SQL statements to crash the application, resulting in a denial of service. • http://seclists.org/fulldisclosure/2020/Dec/32 http://seclists.org/fulldisclosure/2020/Nov/19 http://seclists.org/fulldisclosure/2020/Nov/20 http://seclists.org/fulldisclosure/2020/Nov/22 http://seclists.org/fulldisclosure/2021/Feb/14 https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://security.gentoo.org/glsa/202007-26 https://security.netapp.com/advisory/ntap-20200709-0001 https://support.apple.com/kb/HT211843 https://support.apple.com/kb/HT211844 https • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-9852
https://notcve.org/view.php?id=CVE-2020-9852
An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges. Se abordó un desbordamiento de enteros por medio de una comprobación de entrada mejorada. Este problema es corregido en iOS versión 13.5 y iPadOS versión 13.5, macOS Catalina versión 10.15.5, tvOS versión 13.4.5, watchOS versión 6.2.5. • https://support.apple.com/HT211168 https://support.apple.com/HT211170 https://support.apple.com/HT211171 https://support.apple.com/HT211175 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2020-9842
https://notcve.org/view.php?id=CVE-2020-9842
An entitlement parsing issue was addressed with improved parsing. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application could interact with system processes to access private information and perform privileged actions. Se abordó la cuestión del análisis de los derechos con un análisis mejorado. Este problema está corregido en iOS versión 13.5 y iPadOS versión 13.5, macOS Catalina versión 10.15.5, tvOS versión 13.4.5, watchOS versión 6.2.5. • https://support.apple.com/HT211168 https://support.apple.com/HT211170 https://support.apple.com/HT211171 https://support.apple.com/HT211175 •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-9859 – Apple Multiple Products Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-9859
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges. Se abordó un problema de consumo de memoria con un manejo de memoria mejorado. Este problema esta corregido en iOS versión 13.5.1 y iPadOS versión 13.5.1, Supplemental Update de macOS Catalina versión 10.15.5, tvOS versión 13.4.6, watchOS versión 6.2.6. • https://support.apple.com/HT211214 • CWE-415: Double Free •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-9829
https://notcve.org/view.php?id=CVE-2020-9829
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5. Processing a maliciously crafted text message may lead to application denial of service. Se abordó un problema de comprobación con un saneamiento de entrada mejorado. Este problema es corregido en iOS versión 13.5 y iPadOS versión 13.5, tvOS versión 13.4.5, watchOS versión 6.2.5. • https://support.apple.com/HT211168 https://support.apple.com/HT211171 https://support.apple.com/HT211175 • CWE-20: Improper Input Validation •