Apple iOS: A malicious website may be able to cause a denial of service
Priority LOW 33Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 9 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. A malicious website may be able to cause a denial of service.
Why it matters now
EPSS 0.02009 80th percentileScored 2026-11-07
Fix Partial iOS (Apple): iOS 13.3.1 and iPadOS 13.3.1tvOS (Apple): tvOS 13.3.1+4 more productsRed Hat: 2 advisoriesRed Hat: 9 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apple | iOS | before iOS 13.3.1 and iPadOS 13.3.1 | iOS 13.3.1 and iPadOS 13.3.1 | Patch available | CNA |
| Apple | tvOS | before tvOS 13.3.1 | tvOS 13.3.1 | Patch available | CNA |
| Apple | Safari | before Safari 13.0.5 | Safari 13.0.5 | Patch available | CNA |
| Apple | iTunes for Windows | before iTunes for Windows 12.10.4 | iTunes for Windows 12.10.4 | Patch available | CNA |
| Apple | iCloud for Windows | before iCloud for Windows 11.0 | iCloud for Windows 11.0 | Patch available | CNA |
| Apple | iCloud for Windows (Legacy) | before iCloud for Windows 7.17 | iCloud for Windows 7.17 | Patch available | CNA |
- iOS VendorApple Affected before iOS 13.3.1 and iPadOS 13.3.1 Fixed in iOS 13.3.1 and iPadOS 13.3.1 Patch available CNA
- tvOS VendorApple Affected before tvOS 13.3.1 Fixed in tvOS 13.3.1 Patch available CNA
- Safari VendorApple Affected before Safari 13.0.5 Fixed in Safari 13.0.5 Patch available CNA
- iTunes for Windows VendorApple Affected before iTunes for Windows 12.10.4 Fixed in iTunes for Windows 12.10.4 Patch available CNA
- iCloud for Windows VendorApple Affected before iCloud for Windows 11.0 Fixed in iCloud for Windows 11.0 Patch available CNA
- iCloud for Windows (Legacy) VendorApple Affected before iCloud for Windows 7.17 Fixed in iCloud for Windows 7.17 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* | before 7.17; 10.0 – 10.8 | Vulnerable | Apple |
| cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* | before 12.10.4 | Vulnerable | Apple |
| cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | before 13.0.5 | Vulnerable | Apple |
| cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | before 13.3.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | before 13.3.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | before 13.3.1 | Vulnerable | Apple |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
- cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* Versions before 7.17; 10.0 – 10.8 Vulnerable ·Apple
- cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* Versions before 12.10.4 Vulnerable ·Apple
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* Versions before 13.0.5 Vulnerable ·Apple
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 13.3.1 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 13.3.1 Vulnerable ·Apple
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* Versions before 13.3.1 Vulnerable ·Apple
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
Remediation
- Fix · CNA iOS (Apple) Fixed in iOS 13.3.1 and iPadOS 13.3.1
- Fix · CNA tvOS (Apple) Fixed in tvOS 13.3.1
- Fix · CNA Safari (Apple) Fixed in Safari 13.0.5
- Fix · CNA iTunes for Windows (Apple) Fixed in iTunes for Windows 12.10.4
- Fix · CNA iCloud for Windows (Apple) Fixed in iCloud for Windows 11.0
- Fix · CNA iCloud for Windows (Legacy) (Apple) Fixed in iCloud for Windows 7.17
Red Hat 2 advisories
- RHSA-2020:4451 Released 2020-11-04 · Red Hat rating ModerateGNOME security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder (v. 8) LibRaw-devel-0.19.5-2.el8
- Red Hat Enterprise Linux AppStream (v. 8) LibRaw-0.19.5-2.el8, gnome-settings-daemon-3.32.0-11.el8, webkit2gtk3-2.28.4-1.el8 +3
- RHSA-2020:4035 Released 2020-09-29 · Red Hat rating Moderatewebkitgtk4 security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) webkitgtk4-2.28.2-2.el7, webkitgtk4-jsc-2.28.2-2.el7
- Red Hat Enterprise Linux Client Optional (v. 7) webkitgtk4-devel-2.28.2-2.el7, webkitgtk4-doc-2.28.2-2.el7, webkitgtk4-jsc-devel-2.28.2-2.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) webkitgtk4-2.28.2-2.el7, webkitgtk4-jsc-2.28.2-2.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) webkitgtk4-devel-2.28.2-2.el7, webkitgtk4-doc-2.28.2-2.el7, webkitgtk4-jsc-devel-2.28.2-2.el7
- Red Hat Enterprise Linux Server (v. 7) webkitgtk4-2.28.2-2.el7, webkitgtk4-2.28.2-2.el7.ppc, webkitgtk4-devel-2.28.2-2.el7 +3
- Red Hat Enterprise Linux Server Optional (v. 7) webkitgtk4-devel-2.28.2-2.el7, webkitgtk4-devel-2.28.2-2.el7.ppc, webkitgtk4-doc-2.28.2-2.el7 +2
- Red Hat Enterprise Linux Workstation (v. 7) webkitgtk4-2.28.2-2.el7, webkitgtk4-devel-2.28.2-2.el7, webkitgtk4-jsc-2.28.2-2.el7 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) webkitgtk4-doc-2.28.2-2.el7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apple Safari, iCloud for Windows and 4 more products — openSUSE-SU-2020:0278
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2020-03370 Out-of-bounds write in Apple iOSPriority MEDIUM 43
- TI-2020-03367 Out-of-bounds write in Apple iOSPriority MEDIUM 42
- TI-2020-03369 Cross-site scripting in Apple iOSPriority LOW 30
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4451 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:4035 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:4035 |
Not affected: 3 products
- Red Hat CodeReady Linux Builder (v. 8)
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux BaseOS (v. 8)
Timeline
- 2026-10-02 Threatist record created from CVE-2020-3862
- 2026-10-03 Alias added: GHSA-vq6g-4p44-h8hq
References
More Apple Icloud vulnerabilities
- TI-2019-06084 Type confusion in Apple iOS KEVCVSS 3.1HIGH 8.8
- TI-2020-16987 Type confusion in Apple watchOS KEVCVSS 3.1HIGH 7.8
- TI-2020-07926 Apple iOS: A remote attacker may be able to cause arbitrary code execution CVSS 3.1CRITICAL 9.8
- TI-2018-03187 Memory corruption in Apple WebKit CVSS 3.1HIGH 8.8
- TI-2018-03118 Memory corruption in Apple WebKit CVSS 3.0HIGH 8.8
- TI-2018-03361 Memory corruption in iOS, tvOS, watchOS, Safari, iTunes for Windows, iCloud for Windows CVSS 3.0HIGH 8.8
Sources
- CVE-2020-3862 · CVE Program
- CVE-2020-3862 · NVD
- FIRST EPSS
- GHSA-vq6g-4p44-h8hq · GitHub Advisory Database · CC BY 4.0
- CVE-2020-3862 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences