All vulnerabilities
CVE-2020-27950

Apple Multiple Products Memory Initialization Vulnerability

Apple Multiple Products
Open in ThreatlineRecord JSON
CVSS
5.5Medium
ExploitationExploited in the wildAdded to KEV 3 Nov 2021CISA KEV
Exploit odds (EPSS)16.5%Chance of exploitation activity in the next 30 days, higher than 96% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.1Also 14.2, 11.0 and 5 moreCVE List
Federal deadline3 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 8 Dec 2020, 20:17 UTCPublishedCVE List
  2. 3 Nov 2021Added to CISA KEVCISA KEV

Description

Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory.

Text from CVE List

Affected versions 8

  • watchOSaffected: unspecified before 7.1CVE List
  • iOS and iPadOSaffected: unspecified before 14.2CVE List
  • macOSaffected: unspecified before 11.0CVE List
  • macOSaffected: unspecified before 12.4CVE List
  • macOSaffected: unspecified before 6.2CVE List
  • macOSaffected: unspecified before 5.3CVE List
  • macOSaffected: unspecified before 2020CVE List
  • macOSaffected: unspecified before 10.15CVE List

References 10