CVE-2020-9794: 
SQLite vulnerability analysis and mitigation

CVE-2020-9794 is an out-of-bounds read vulnerability that was discovered and patched in May 2020. The vulnerability affected multiple Apple products including iOS 13.5, iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, and iCloud for Windows 7.19 (Apple Support, Apple Support).

The vulnerability is classified as an out-of-bounds read issue in the SQLite component that was addressed with improved bounds checking. The vulnerability has a CVSS v3.1 Base Score of 8.1 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H (NVD).

When exploited, this vulnerability could allow a malicious application to cause a denial of service or potentially disclose memory contents (Apple Support, Apple Support).

The vulnerability requires user interaction and can be exploited remotely. The attack complexity is considered low, and no privileges are required to execute the attack (NVD).

Apple addressed this vulnerability by implementing improved bounds checking in the affected products. The fix was released in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, and iCloud for Windows 7.19 (Apple Support, Apple Support).