4 ms·
The Apple product security team just submitted this to the Full Disclosure mailing list[0]. There's a Python arbitrary remote code execution flaw addressed in t
by vngzs 6y ago
The Apple product security team just submitted this to the Full Disclosure mailing list[0]. There's a Python arbitrary remote code execution flaw addressed in this update (CVE-2020-9793). The same flaw is present in iOS as well[1][2].
[0]: http://seclists.org/fulldisclosure/2020/May/53 http://seclists.org/fulldisclosure/2020/May/53
[1]: http://seclists.org/fulldisclosure/2020/May/49 http://seclists.org/fulldisclosure/2020/May/49
[2]: https://support.apple.com/en-us/HT211168 https://support.apple.com/en-us/HT211168
- JonathonW 6y agoThe Python vulnerability has been removed from the iOS vulnerability list on Apple Support... iOS does not ship Python, so it was likely included by mistake.
- vngzs 6y agoAh, it has! That explains my confusion about why Python is even present on iOS. There's still a good meat of interesting vulnerabilities here, but many of the interesting ones have hidden details for now. I'm looking forward to when the full CVEs come out.
- snazz 6y agoYes. There was also a Zsh vulnerability mistakenly included in the iOS list.
- mistrial9 6y agohttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492 .. leads to https://bugs.python.org/issue39503 https://bugs.python.org/issue39503 which is no-big-deal https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9793 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9793 .. is cloaked.. but personally I am sceptical of "giant ball of fixes" with "urgent/required priority" that actually "do other things the vendor wants besides the advertised fix" and "aggrandizes obscure vulnerabilities as a security treadmill"
- saagarjha 6y agoThis is also available through https://lists.apple.com/mailman/listinfo/security-announce https://lists.apple.com/mailman/listinfo/security-announce.