CVE-2020-9806: 
Apple iCloud vulnerability analysis and mitigation

CVE-2020-9806 is a memory corruption vulnerability discovered in WebKit that was addressed by Apple in May 2020. The vulnerability affects multiple Apple products including iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, and iCloud for Windows 7.19. The issue was discovered by Wen Xu of SSLab at Georgia Tech (Apple HT211168, CVE MITRE).

The vulnerability is a memory corruption issue in WebKit that was addressed with improved state management. It has a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write) (NVD).

When exploited, processing maliciously crafted web content may lead to arbitrary code execution on the affected system. This could allow attackers to execute malicious code in the context of the WebKit process (Apple HT211168).

The vulnerability requires user interaction, specifically processing maliciously crafted web content. It can be exploited remotely through network access, requires no privileges, and has low attack complexity (NVD).

Apple addressed this vulnerability by releasing security updates for affected products: iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, and iCloud for Windows 7.19. Users should update to these versions or later to mitigate the vulnerability (Apple HT211168).