CVE-2020-13524

Опубликовано: 03 дек. 2020

Источник: nvd

CVSS3: 6.3

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

An out-of-bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 uses SPECS data from binary USD files. A specially crafted malformed file can trigger an out-of-bounds memory access and modification which results in memory corruption. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file.

Ссылки

http://seclists.org/fulldisclosure/2020/Dec/26
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2020/Dec/32
Mailing List
Third Party Advisory
https://support.apple.com/kb/HT212011
Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1125
Exploit
Third Party Advisory
http://seclists.org/fulldisclosure/2020/Dec/26
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2020/Dec/32
Mailing List
Third Party Advisory
https://support.apple.com/kb/HT212011
Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1125
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pixar:openusd:20.05:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Версия от 10.14.0 (включая) до 10.14.6 (исключая)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Версия от 10.15 (включая) до 10.15.7 (исключая)

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 11.0 (включая) до 11.1 (исключая)

EPSS

Процентиль: 61%

0.00411

Низкий

6.3 Medium

CVSS3

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-119

CWE-787

Связанные уязвимости

GHSA-8f9r-9957-fj34

CVSS3: 5.5

github

больше 3 лет назад

EPSS

Процентиль: 61%

0.00411

Низкий

6.3 Medium

CVSS3

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-119

CWE-787