CVE-2020-27950

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.

• CWE-665
• CWE-665

• http://packetstormsecurity.com/files/161296/XNU-Kernel-Mach-Message-Trailers-Memory-Disclosure.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Dec/32Mailing List, Third Party Advisory
• https://support.apple.com/en-us/HT211928Vendor Advisory
• https://support.apple.com/en-us/HT211929Vendor Advisory
• https://support.apple.com/en-us/HT211931Vendor Advisory
• https://support.apple.com/en-us/HT211940Vendor Advisory
• https://support.apple.com/en-us/HT211944Vendor Advisory
• https://support.apple.com/en-us/HT211945Vendor Advisory
• https://support.apple.com/en-us/HT211946Vendor Advisory
• https://support.apple.com/en-us/HT211947Vendor Advisory
• http://packetstormsecurity.com/files/161296/XNU-Kernel-Mach-Message-Trailers-Memory-Disclosure.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Dec/32Mailing List, Third Party Advisory
• https://support.apple.com/en-us/HT211928Vendor Advisory
• https://support.apple.com/en-us/HT211929Vendor Advisory
• https://support.apple.com/en-us/HT211931Vendor Advisory
• https://support.apple.com/en-us/HT211940Vendor Advisory
• https://support.apple.com/en-us/HT211944Vendor Advisory
• https://support.apple.com/en-us/HT211945Vendor Advisory
• https://support.apple.com/en-us/HT211946Vendor Advisory
• https://support.apple.com/en-us/HT211947Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27950US Government Resource

Published

Dec 8, 2020

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27945An integer overflow was addressed with improved input valida…7.8
• CVE-2020-27946An information disclosure issue was addressed with improved …5.5
• CVE-2020-27947A memory corruption issue was addressed with improved input …7.8
• CVE-2020-27948An out-of-bounds write issue was addressed with improved bou…7.8
• CVE-2020-27949This issue was addressed with improved checks to prevent una…5.5
• CVE-2020-2795Vulnerability in the Oracle Knowledge product of Oracle Know…6.3
• CVE-2020-27951This issue was addressed with improved checks. This issue is…7.8
• CVE-2020-27952An out-of-bounds write was addressed with improved input val…7.8
• CVE-2020-27955Git LFS 2.12.0 allows Remote Code Execution.9.8
• CVE-2020-27956An Arbitrary File Upload in the Upload Image component in So…9.8
• CVE-2020-27957The RandomGameUnit extension for MediaWiki through 1.35 was …5.4
• CVE-2020-27958The Job Composer app in Ohio Supercomputer Center Open OnDem…4.3