About the security content of iOS 13.6 and iPadOS 13.6

This document describes the security content of iOS 13.6 and iPadOS 13.6.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

iOS 13.6 and iPadOS 13.6

Released July 15, 2020

Audio

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9888: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab

CVE-2020-9890: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab

CVE-2020-9891: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab

Audio

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9884: Yu Zhou(@yuzhou6666) of 小鸡帮 working with Trend Micro Zero Day Initiative

CVE-2020-9889: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab

Entry updated July 24, 2020

AVEVideoEncoder

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed by removing the vulnerable code.

CVE-2020-9907: an anonymous researcher

AVEVideoEncoder

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed by removing the vulnerable code.

CVE-2020-9907: 08Tc3wBB

Entry updated July 24, 2020

Bluetooth

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may cause an unexpected application termination

Description: A denial of service issue was addressed with improved input validation.

CVE-2020-9931: Dennis Heinze (@ttdennis) of TU Darmstadt, Secure Mobile Networking Lab

CoreFoundation

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A local user may be able to view sensitive user information

Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation.

CVE-2020-9934: an anonymous researcher

CoreGraphics

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2020-9883: Mickey Jin of Trend Micro

Entry added July 24, 2020

Crash Reporter

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to break out of its sandbox

Description: A memory corruption issue was addressed by removing the vulnerable code.

CVE-2020-9865: Zhuo Liang of Qihoo 360 Vulcan Team working with 360 BugCloud

GeoServices

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to read sensitive location information

Description: An authorization issue was addressed with improved state management.

CVE-2020-9933: Min (Spark) Zheng and Xiaolong Bai of Alibaba Inc.

iAP

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An attacker in a privileged network position may be able to perform denial of service attack using malformed Bluetooth packets

Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation.

CVE-2020-9914: Andy Davis of NCC Group

Entry updated July 24, 2020

ImageIO

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9871: Xingwei Lin of Ant-financial Light-Year Security Lab

CVE-2020-9872: Xingwei Lin of Ant-financial Light-Year Security Lab

CVE-2020-9936: Mickey Jin of Trend Micro

Entry updated July 24, 2020

ImageIO

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2020-9919:  Mickey Jin of Trend Micro

Entry added July 24, 2020

ImageIO

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2020-9876: Mickey Jin of Trend Micro

Entry added July 24, 2020

ImageIO

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9873: Xingwei Lin of Ant-financial Light-Year Security Lab

CVE-2020-9938: Xingwei Lin of Ant-financial Light-Year Security Lab

Entry added July 24, 2020

Kernel

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-9923: Proteas

Kernel

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An attacker in a privileged network position may be able to inject into active connections within a VPN tunnel

Description: A routing issue was addressed with improved restrictions.

CVE-2019-14899: William J. Tolley, Beau Kujath, and Jedidiah R. Crandall

Kernel

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-9909: Brandon Azad of Google Project Zero

Kernel

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-9904: Tielei Wang of Pangu Lab

Entry added July 24, 2020

Kernel

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2020-9863: an anonymous researcher

Entry added July 24, 2020

Kernel

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: Multiple memory corruption issues were addressed with improved state management.

CVE-2020-9892: Andy Nguyen of Google

Entry added July 24, 2020

Mail

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause a denial of service

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2019-19906

Entry updated July 24, 2020

Mail

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious mail server may overwrite arbitrary mail files

Description: A path handling issue was addressed with improved validation.

CVE-2020-9920: YongYue Wang AKA BigChan of Hillstone Networks AF Team

Entry added July 24, 2020

Messages

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A user that is removed from an iMessage group could rejoin the group

Description: An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification.

CVE-2020-9885: an anonymous researcher, Suryansh Mansharamani, of WWP High School North (medium.com/@suryanshmansha)

Model I/O

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2020-9878: Holger Fuhrmannek of Deutsche Telekom Security

Safari Login AutoFill

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious attacker may cause Safari to suggest a password for the wrong domain

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9903: Nikhil Mittal (@c0d3G33k) of Payatu Labs (payatu.com)

Safari Reader

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An issue in Safari Reader mode may allow a remote attacker to bypass the Same Origin Policy

Description: A logic issue was addressed with improved restrictions.

CVE-2020-9911: Nikhil Mittal (@c0d3G33k) of Payatu Labs (payatu.com)

Security

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate

Description: A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation.

CVE-2020-9868: Brian Wolff of Asana

Entry added July 24, 2020

WebKit

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9894: 0011 working with Trend Micro Zero Day Initiative

WebKit

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced

Description: An access issue existed in Content Security Policy.  This issue was addressed with improved access restrictions.

CVE-2020-9915: Ayoub AIT ELMOKHTAR of Noon

Entry updated July 24, 2020

WebKit

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: A use after free issue was addressed with improved memory management.

CVE-2020-9893: 0011 working with Trend Micro Zero Day Initiative

CVE-2020-9895: Wen Xu of SSLab, Georgia Tech

WebKit

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue was addressed with improved state management.

CVE-2020-9925: an anonymous researcher

WebKit

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication

Description: Multiple issues were addressed with improved logic.

CVE-2020-9910: Samuel Groß of Google Project Zero

WebKit Page Loading

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A malicious attacker may be able to conceal the destination of a URL

Description: A URL Unicode encoding issue was addressed with improved state management.

CVE-2020-9916: Rakesh Mane (@RakeshMane10)

WebKit Web Inspector

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: Copying a URL from Web Inspector may lead to command injection

Description: A command injection issue existed in Web Inspector. This issue was addressed with improved escaping.

CVE-2020-9862: Ophir Lojkine (@lovasoa)

Wi-Fi

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-9918: Jianjun Dai of 360 Alpha Lab working with 360 BugCloud (bugcloud.360.cn)

Wi-Fi

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-9906: Ian Beer of Google Project Zero

Entry added July 24, 2020

Wi-Fi

Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation

Impact: A remote attacker may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2020-9917: Pradeep Deokate of Harman, Stefan Böhrer at Daimler AG, proofnet.de

Entry updated July 24, 2020

Additional recognition

Bluetooth

We would like to acknowledge Andy Davis of NCC Group for their assistance.

Kernel

We would like to acknowledge Brandon Azad of Google Project Zero for their assistance.

USB Audio

We would like to acknowledge Andy Davis of NCC Group for their assistance.

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: