CVE-2020-3894 Race condition in Safari

Low 3.1 Published 1 Apr 2020 Updated 4 Aug 2024

A race condition allows an application to read restricted memory, affecting Apple operating systems and related software.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-3894?

CVE-2020-3894 is a low-severity vulnerability in Apple Icloud, published on 1 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.

Weakness: CWE-362

Which versions are affected by CVE-2020-3894?

It affects 6 products.

Products include Apple Icloud, Apple Ipad Os, Apple Iphone Os, Apple Itunes, Apple Safari, Apple Tvos.

How do I fix CVE-2020-3894?

Upgrade to a fixed version.

Is CVE-2020-3894 being exploited?

There is no known exploitation of CVE-2020-3894 in the wild and no public exploit code.

All Apple Icloud vulnerabilities

Sources

Also known as DEBIAN-CVE-2020-3894, GHSA-86x5-95qc-wmgh, UBUNTU-CVE-2020-3894.