CVE-2020-9816: 
macOS vulnerability analysis and mitigation

CVE-2020-9816 is an out-of-bounds write vulnerability discovered in Apple's FontParser component. The vulnerability was disclosed and patched in May 2020, affecting multiple Apple operating systems including iOS 13.5, iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5. The vulnerability was discovered by Peter Nguyen Vu Hoang of STAR Labs working with Trend Micro Zero Day Initiative (Apple iOS, Apple macOS).

The vulnerability is characterized as an out-of-bounds write issue in the FontParser component when processing PDF files. The issue was addressed by implementing improved bounds checking in the affected systems. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and a CVSS v2.0 base score of 9.3 (HIGH) with the vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

Opening a maliciously crafted PDF file could lead to an unexpected application termination or arbitrary code execution on the affected system. This vulnerability could potentially allow attackers to execute malicious code with elevated privileges when a user opens a specially crafted PDF document (Apple iOS, Apple macOS).

The vulnerability requires user interaction to exploit, as it is triggered by opening a maliciously crafted PDF file. The attack complexity is considered low, requiring no special privileges for exploitation, though it does need the user to interact with the malicious file (NVD).

Apple addressed this vulnerability by releasing security updates for all affected operating systems: iOS 13.5, iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5. Users are advised to update their devices to these versions or later to protect against this vulnerability (Apple iOS, Apple macOS).