CVE-2020-3865 (CNNVD-202001-1411)
中文标题:
多款Apple产品缓冲区错误漏洞
英文标题:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed ...
漏洞描述
中文描述:
Apple Safari等都是美国苹果（Apple）公司的产品。Apple Safari是一款Web浏览器，是Mac OS X和iOS操作系统附带的默认浏览器。WebKit Page Loading是其中的一个页面加载组件。Apple tvOS是一套智能电视操作系统。Apple iCloud for Windows是一款基于Windows平台的云服务。该产品支持存储音乐、照片、App和联系人等。 多款Apple产品中的WebKit Page Loading组件存在安全漏洞。攻击者可借助恶意制作的网页内容利用该漏洞执行任意代码。以下产品及版本受到影响：基于Windows平台的iCloud 10.9.2之前版本，7.17之前版本；基于Windows平台的iTunes 12.10.4之前版本；Apple tvOS 13.3.1之前版本；Safari 13.0.5之前版本。
英文描述:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Apple | iOS | - | < iOS 13.3.1 and iPadOS 13.3.1 | - |
cpe:2.3:a:apple:ios:*:*:*:*:*:*:*:*
|
| Apple | tvOS | - | < tvOS 13.3.1 | - |
cpe:2.3:a:apple:tvos:*:*:*:*:*:*:*:*
|
| Apple | Safari | - | < Safari 13.0.5 | - |
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
|
| Apple | iTunes for Windows | - | < iTunes for Windows 12.10.4 | - |
cpe:2.3:a:apple:itunes_for_windows:*:*:*:*:*:*:*:*
|
| Apple | iCloud for Windows | - | < iCloud for Windows 11.0 | - |
cpe:2.3:a:apple:icloud_for_windows:*:*:*:*:*:*:*:*
|
| Apple | iCloud for Windows (Legacy) | - | < iCloud for Windows 7.17 | - |
cpe:2.3:a:apple:icloud_for_windows_(legacy):*:*:*:*:*:*:*:*
|
| apple | icloud | * | - | - |
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
|
| apple | itunes | * | - | - |
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
|
| apple | safari | * | - | - |
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
|
| apple | ipados | * | - | - |
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
|
| apple | iphone_os | * | - | - |
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
|
| apple | tvos | * | - | - |
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
|
| opensuse | leap | 15.1 | - | - |
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2020-3865 |
2025-11-11 15:20:37 | 2025-11-11 07:36:22 |
| NVD | nvd_CVE-2020-3865 |
2025-11-11 14:56:56 | 2025-11-11 07:44:46 |
| CNNVD | cnnvd_CNNVD-202001-1411 |
2025-11-11 15:10:21 | 2025-11-11 07:55:20 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 缓冲区错误
- cnnvd_id: 未提取 -> CNNVD-202001-1411
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 8.8
- cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- cvss_version: NOT_EXTRACTED -> 3.1
- affected_products_count: 6 -> 13
- data_sources: ['cve'] -> ['cve', 'nvd']