CVE-2020-9910

Multiple issues were addressed with improved logic. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

Affected

Apple · iOS · tvOS · watchOS · Safari · iTunes for Windows · iCloud for Windows

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

2.19% chance of exploitation in the next 30 days, 82nd percentile

Published

2020-10-16

Updated

2024-08-04

Proof-of-concept exploits (1)

• Chaos192/test3★ · 2021-04-09

Security advisories

• https://support.apple.com/HT211288
• https://support.apple.com/HT211290
• https://support.apple.com/HT211291
• https://support.apple.com/HT211292
• https://support.apple.com/HT211293
• https://support.apple.com/HT211294
• https://support.apple.com/HT211295

References

• CVE Record
• NVD entry

Related

• CVE-2020-9802