CVE-2020-3898: apple mac_os_x Improper Input Validation
CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2020-3898SUSE-SU-2020:1045-1SUSE-SU-2020:1083-1SUSE-SU-2020:14341-1RHSA-2020:4469UBUNTU-CVE-2020-3898DEBIAN-CVE-2020-3898openSUSE-SU-2020:0555-1
Published 22-10-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-3898 is a high (CVSS 7.8) Improper Input Validation vulnerability in apple mac_os_x. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.6% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 22-10-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources5 sources · 4.5–7.8
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 18-09-2026
18-09-202618-10-2026
EPSS score0.39%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Suse27 products
- cups&distro=HPE Helion OpenStack 8< 1.7.5-20.29.1
- cups&distro=SUSE Enterprise Storage 5< 1.7.5-20.29.1
- cups&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 2.2.7-3.17.1
- cups&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 2.2.7-3.17.1
- cups&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.2.7-3.17.1
Redhat13 products
- cups< 1:2.2.6-38.el8
- cups-client< 1:2.2.6-38.el8
- cups-client-debuginfo< 1:2.2.6-38.el8
- cups-debuginfo< 1:2.2.6-38.el8
- cups-debugsource< 1:2.2.6-38.el8
Alpine1 product
- cups< 2.2.12-r1 | < 2.2.12-r2 | < 2.3.3-r0
Debian1 product
- cups< 2.3.1-12
Opensuse1 product
- cups&distro=openSUSE Leap 15.1< 2.2.7-lp151.6.6.1
Ubuntu1 product
- cups< 2.1.3-4ubuntu0.11 | < 2.2.7-1ubuntu2.8 | < 2.3.1-9ubuntu1.1
7 vendors · 46 products
References
26 linksShow all 26 references
- lists.opensuse.org/archives/…Advisory