CVE-2020-3911 Memory corruption in iCloud for Windows

Critical 9.8 Published 1 Apr 2020 Updated 4 Aug 2024

A buffer overflow in libxml2 allows attackers to execute arbitrary code on Apple operating systems and related Windows applications.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3911?

CVE-2020-3911 is a critical memory corruption vulnerability in Apple Icloud, published on 1 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Multiple issues in libxml2.

Weakness: CWE-120

Which versions are affected by CVE-2020-3911?

It affects 7 products.

Products include Apple Icloud, Apple Ipados, Apple Iphone Os, Apple Itunes, Apple Mac Os X, Apple Tvos and 1 more.

How do I fix CVE-2020-3911?

No fix has been published for CVE-2020-3911 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-3911 being exploited?

There is no known exploitation of CVE-2020-3911 in the wild and no public exploit code.

All Apple Icloud vulnerabilities

Sources

Also known as GHSA-4736-pcjr-h7qf.