CVE-2020-9973: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave, iOS 14.0 and...

Summary

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave, iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted USD file may lead to unexpected application termination ...

What to do

Update apple ipados to version 14.0 or later.
Update apple iphone_os to version 14.0 or later.

Affected software

Vendor	Product	Affected versions
apple	ipados	< 14.0 `cpe:2.3:o:apple:ipados::::::::`
apple	iphone_os	< 14.0 `cpe:2.3:o:apple:iphone_os::::::::`
apple	mac_os_x	>= 10.13, < 10.13.6 >= 10.14, < 10.14.6 >= 10.15, < 10.15.7 10.13.6 10.14.6 `cpe:2.3:o:apple:mac_os_x::::::::`

Original advisory text

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave, iOS 14.0 and...

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave, iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.

References

http://seclists.org/fulldisclosure/2020/Nov/20 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/21 Mailing List Third Party Advisory
https://support.apple.com/en-us/HT211849 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT211850 Release Notes Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1104 Third Party Advisory