About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra

This document describes the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra.

About Apple security updates

For our customers’ protection, Apple doesn’t disclose, discuss or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra

Released 15 July 2020

AMD

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-9927: Lilang Wu working with TrendMicro’s Zero Day Initiative

Entry added 24 July 2020

Audio

Available for: macOS Catalina 10.15.5

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9884: Yu Zhou(@yuzhou6666) of 小鸡帮 working with Trend Micro Zero Day Initiative

CVE-2020-9889: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab

Audio

Available for: macOS Catalina 10.15.5

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9888: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab

CVE-2020-9890: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab

CVE-2020-9891: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab

Clang

Available for: macOS Catalina 10.15.5

Impact: Clang may generate machine code that does not correctly enforce pointer authentication codes

Description: A logic issue was addressed with improved validation.

CVE-2020-9870: Samuel Groß of Google Project Zero

CoreAudio

Available for: macOS High Sierra 10.13.6

Impact: A buffer overflow may result in arbitrary code execution

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2020-9866: Yu Zhou of 小鸡帮 and Jundong Xie of Ant-financial Light-Year Security Lab

CoreFoundation

Available for: macOS Catalina 10.15.5

Impact: A local user may be able to view sensitive user information

Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation.

CVE-2020-9934: an anonymous researcher

CoreGraphics

Available for: macOS Catalina 10.15.5

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2020-9883: Mickey Jin of Trend Micro

Entry added 24 July 2020

Crash Reporter

Available for: macOS Catalina 10.15.5

Impact: A malicious application may be able to break out of its sandbox

Description: A memory corruption issue was addressed by removing the vulnerable code.

CVE-2020-9865: Zhuo Liang of Qihoo 360 Vulcan Team working with 360 BugCloud

Graphics Drivers

Available for: macOS Catalina 10.15.5

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9799: ABC Research s.r.o.

Entry updated 24 July 2020

Heimdal

Available for: macOS Catalina 10.15.5

Impact: A local user may be able to leak sensitive user information

Description: This issue was addressed with improved data protection.

CVE-2020-9913: Cody Thomas of SpecterOps

ImageIO

Available for: macOS Catalina 10.15.5

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9871: Xingwei Lin of Ant-financial Light-Year Security Lab

CVE-2020-9872: Xingwei Lin of Ant-financial Light-Year Security Lab

CVE-2020-9936: Mickey Jin of Trend Micro

Entry updated 24 July 2020

ImageIO

Available for: macOS Catalina 10.15.5

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2020-9919: Mickey Jin of Trend Micro

Entry added 24 July 2020

ImageIO

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5

Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9876: Mickey Jin of Trend Micro

Entry added 24 July 2020

ImageIO

Available for: macOS Catalina 10.15.5

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9873: Xingwei Lin of Ant-financial Light-Year Security Lab

CVE-2020-9938: Xingwei Lin of Ant-financial Light-Year Security Lab

Entry added 24 July 2020

Intel Graphics Driver

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9908: Junzhi Lu(@pwn0rz) of Trend Micro

Entry added 24 July 2020

Kernel

Available for: macOS Catalina 10.15.5

Impact: An attacker in a privileged network position may be able to inject into active connections within a VPN tunnel

Description: A routing issue was addressed with improved restrictions.

CVE-2019-14899: William J. Tolley, Beau Kujath and Jedidiah R. Crandall

Kernel

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9904: Tielei Wang of Pangu Lab

Entry added 24 July 2020

Kernel

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5

Impact: A remote attacker may be able to cause a denial of service

Description: A logic issue was addressed with improved state management.

CVE-2020-9924: Matt DeVore of Google

Entry added 24 July 2020

Kernel

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: Multiple memory corruption issues were addressed with improved state management.

CVE-2020-9892: Andy Nguyen of Google

Entry added 24 July 2020

Kernel

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory initialisation issue was addressed with improved memory handling.

CVE-2020-9863: an anonymous researcher

Entry added 24 July 2020

Mail

Available for: macOS Catalina 10.15.5

Impact: A remote attacker may be able to cause a denial of service

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2019-19906

Entry updated 24 July 2020

Mail

Available for: macOS Catalina 10.15.5

Impact: A malicious mail server may overwrite arbitrary mail files

Description: A path handling issue was addressed with improved validation.

CVE-2020-9920: YongYue Wang AKA BigChan of Hillstone Networks AF Team

Entry added 24 July 2020

Messages

Available for: macOS Catalina 10.15.5

Impact: A user that is removed from an iMessage group could rejoin the group

Description: An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification.

CVE-2020-9885: an anonymous researcher, Suryansh Mansharamani, of WWP High School North (medium.com/@suryanshmansha)

Model I/O

Available for: macOS Catalina 10.15.5

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2020-9878: Holger Fuhrmannek of Deutsche Telekom Security

Model I/O

Available for: macOS Mojave 10.14.6

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2020-9880: Holger Fuhrmannek of Deutsche Telekom Security

Entry added 24 July 2020

Model I/O

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.5

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2020-9878: Holger Fuhrmannek of Deutsche Telekom Security

CVE-2020-9881: Holger Fuhrmannek of Deutsche Telekom Security

CVE-2020-9882: Holger Fuhrmannek of Deutsche Telekom Security

Entry added 24 July 2020

rsync

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6

Impact: A remote attacker may be able to overwrite existing files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2014-9512: gaojianfeng

Entry added 24 July 2020

Security

Available for: macOS Catalina 10.15.5

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9864: Alexander Holodny

Security

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5

Impact: An attacker may have been able to impersonate a trusted website using shared key material for an administrator-added certificate

Description: A certificate validation issue existed when processing administrator-added certificates. This issue was addressed with improved certificate validation.

CVE-2020-9868: Brian Wolff of Asana

Entry added 24 July 2020

Security

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6

Impact: An application may be able to gain elevated privileges

Description: A logic issue was addressed with improved validation.

CVE-2020-9854: Ilias Morad (A2nkF)

Entry added 24 July 2020

Vim

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6

Impact: A remote attacker may be able to cause arbitrary code execution

Description: This issue was addressed with improved checks.

CVE-2019-20807: Guilherme de Almeida Suckevicz

Wi-Fi

Available for: macOS Catalina 10.15.5

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9918: Jianjun Dai of 360 Alpha Lab working with 360 BugCloud (bugcloud.360.cn)

Wi-Fi

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.5

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-9899: Yu Wang of Didi Research America

Entry added 24 July 2020

Wi-Fi

Available for: macOS Catalina 10.15.5

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-9906: Ian Beer of Google Project Zero

Entry added 24 July 2020

Additional recognition

USB Audio

We would like to acknowledge Andy Davis of NCC Group for their assistance.

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: