CVE-2020-9807: 
Apple iCloud vulnerability analysis and mitigation

CVE-2020-9807 is a memory corruption vulnerability discovered in WebKit that was addressed by Apple in May 2020. The vulnerability affects multiple Apple products including iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, and iCloud for Windows 7.19. The issue was discovered by Wen Xu of SSLab at Georgia Tech (Apple Security).

The vulnerability is a memory corruption issue in WebKit that was addressed with improved state management. It has a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write) (NVD).

Processing maliciously crafted web content may lead to arbitrary code execution on affected systems. The vulnerability affects confidentiality, integrity, and availability of the system with high severity impacts (NVD).

The vulnerability requires user interaction (processing maliciously crafted web content) but can be exploited remotely with no privileges required. The attack complexity is considered low (NVD).

Apple has released security updates to address this vulnerability across multiple products: iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, and iCloud for Windows 7.19. Users should update to these versions or later to mitigate the vulnerability (Apple Security).