Skip to content
OpenAdvisories
Unscored CVE-2020-9900 EUVD-2020-30679GHSA-24hp-jpqm-m2j2

An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fix…

Published Oct 22, 2020 · Updated Aug 4, 2024 · Assigned by apple

Vendor: Apple Product: iOS Product: macOS Product: tvOS Product: watchOS Platform: iOS Platform: macOS

Description

An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A local attacker may be able to elevate their privileges.

Affected products

VendorProductAffectedFixed
Apple iOS unspecified – < iOS 13.6 and iPadOS 13.6 iOS 13.6 and iPadOS 13.6
Apple macOS unspecified – < macOS Catalina 10.15.6 macOS Catalina 10.15.6
Apple tvOS unspecified – < tvOS 13.4.8 tvOS 13.4.8
Apple watchOS unspecified – < watchOS 6.2.8 watchOS 6.2.8

References