SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Apple Security Updates March 2020 and Adobe Creative Cloud Critical Security Update

Apple finally released Security Updates in March 2020 for multiple products today. A total of 49 vulnerabilities were addressed. However, Exploiting some of these security flaws could allow an attacker to take control of an affected system. Hence, Vulnerability Management System is the solution to t

Mar 26, 20206 min read

Apple finally released Security Updates in March 2020 for multiple products today. A total of 49 vulnerabilities were addressed. However, Exploiting some of these security flaws could allow an attacker to take control of an affected system. Hence, Vulnerability Management System is the solution to these problems. Adobe also released an out-of-band security update for critical arbitrary file deletion vulnerability in Creative Cloud. Therefore, a good Vulnerability Management Software can prevent these attacks.

Critical vulnerabilities in Apple products

The update for macOS includes fixes for 27 vulnerabilities, which could finally allow an attacker to execute arbitrary code with kernel privileges, disclose sensitive information, escalate privileges, cause memory corruption, etc.

A total of 11 vulnerabilities have been fixed in Apple Safari. Moreover, Arbitrary code execution or cross-site scripting attacks could be carried out using maliciously crafted web content, and an application may be able to read restricted memory. Finally, Apple fixed this issue by including additional validations.

A type of confusion issue was present in Apple iTunes, which could be used to process maliciously crafted web content leading to arbitrary code execution. Hence, this vulnerability was addressed with improved memory handling.

Therefore, a race condition issue was addressed in Apple iCloud for Windows 7 and Windows 10 through Windows Store. Moreover, Successful exploitation may allow an application to read restricted memory.

Critical security update for Adobe Creative Cloud

The time-of-check to time-of-use (TOCTOU) race condition vulnerability is regarded as critical in severity and can result in arbitrary file deletion. Hence, a Creative Cloud is a set of applications and services from Adobe Inc. A user can subscribe and can get access to a collection of software such as Adobe Photoshop, Adobe Premiere Pro, After Effects, etc. which can be in use for graphic design, video editing, photography, and various other applications.

However, this vulnerability which allows an attacker to delete arbitrary files, occurs due to a race condition, i.e., when two or more systems or processes access shared resources and intend to modify the data. Hence, the time-of-check to time-of-use race condition checks for the specified resources and, at the same time, uses the result from the resource check performed. Therefore, an attacker can delete arbitrary files on the target system if successfully exploited.

Adobe has finally released updates to fix this vulnerability. Hence, We strongly recommend installing these security updates as soon as possible.

Apple Security Updates Summary for March 2020 and Adobe Creative Cloud Out-of-Band Security Update:

macOS

  • Affected OS: macOS Catalina, Mojave, and High SierraAffected features: HSSPI Support, AppleGraphicsControl, AppleMobileFileIntegrity, Bluetooth, Call History, CoreFoundation, FaceTime, Icons, Intel Graphics Driver, IOHIDFamily, IOThunderboltFamily, Kernel, libxml2, Mail, sudo, TCC, Time Machine, VimImpact: Information Disclosure, Privilege Escalation, arbitrary code execution, memory corruption
  • CVEs: CVE-2019-14615, CVE-2019-19232, CVE-2019-8853, CVE-2020-3851, CVE-2020-3881, CVE-2020-3883, CVE-2020-3884, CVE-2020-3889, CVE-2020-3892, CVE-2020-3893, CVE-2020-3903, CVE-2020-3904, CVE-2020-3905, CVE-2020-3906, CVE-2020-3907, CVE-2020-3908, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-3912, CVE-2020-3913, CVE-2020-3914, CVE-2020-3919, CVE-2020-9769, CVE-2020-9773, CVE-2020-9776, CVE-2020-9785

Safari

  • Affected OS: macOS Mojave, macOS High Sierra, and macOS Catalina
  • Affected features: Safari Downloads, WebKit, WebKit Page Loading
  • Impact: Information Disclosure, Cross-Site scripting, Incorrect file URL processing, Arbitrary code execution
  • CVEs: CVE-2020-3885, CVE-2020-3887, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9783, CVE-2020-9784

iTunes

  • Affected OS: Windows 7 and later
  • Affected features: libxml2, WebKit, WebKit Page Loading
  • Impact: Incorrect file URL processing, Cross-Site scripting, Arbitrary code execution
  • CVEs: CVE-2020-3885, CVE-2020-3887, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-9783

tvOS

  • Affected OS: Apple TV 4K and Apple TV HD
  • Affected features: ActionKit, AppleMobileFileIntegrity, Icons, Image Processing, IOHIDFamily, Kernel, libxml2, WebKit, WebKit Page Loading
  • Impact: Information Disclosure, Incorrect file URL processing, Arbitrary Code Execution, Privilege Escalation
  • CVEs: CVE-2020-3883, CVE-2020-3885, CVE-2020-3887, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-3914, CVE-2020-3917, CVE-2020-3919, CVE-2020-9768, CVE-2020-9773, CVE-2020-9783, CVE-2020-9785

watchOS

  • Affected OS: watchOS
  • Affected features: ActionKit, AppleMobileFileIntegrity, CoreFoundation, Icons, Image Processing, IOHIDFamily, Kernel, libxml2, Messages, WebKit
  • Impact: Arbitrary Code Execution, Privilege Escalation, Information Disclosure
  • CVEs: CVE-2020-3883, CVE-2020-3891, CVE-2020-3895, CVE-2020-3897, CVE-2020-3900, CVE-2020-3901, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-3913, CVE-2020-3914, CVE-2020-3916, CVE-2020-3917, CVE-2020-3919, CVE-2020-9768, CVE-2020-9773, CVE-2020-9785

iOS and iPadOS

  • Affected OS: iOS and iPad
  • Affected features: ActionKit, Bluetooth, AppleMobileFileIntegrity, CoreFoundation, Icons, Image Processing, IOHIDFamily, Kernel, libxml2, Mail, Mail Attachments, Messages, Messages Composition, Safari, Web App, WebKit, WebKit Page Loading
  • Impact: Arbitrary Code Execution, Privilege Escalation, Information Disclosure
  • CVEs: CVE-2020-3883, CVE-2020-3885, CVE-2020-3887, CVE-2020-3888, CVE-2020-3890, CVE-2020-3891, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-3913, CVE-2020-3914, CVE-2020-3916, CVE-2020-3917, CVE-2020-3919, CVE-2020-9768, CVE-2020-9770, CVE-2020-9773, CVE-2020-9775, CVE-2020-9777, CVE-2020-9780, CVE-2020-9781, CVE-2020-9783, CVE-2020-9785

iCloud

  • Product: iCloud
  • Affected OS: Windows 7 and Windows 10
  • Affected features: libxml2, WebKit, WebKit Page Loading
  • Impact: Arbitrary Code Execution, Cross-Site scripting, Incorrect file URL processing
  • CVEs: CVE-2020-3885, CVE-2020-3887, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-9783

Adobe Creative Cloud

  • Product: Adobe Creative Cloud 5.0 and earlier versions
  • Affected OS : Windows
  • Impact: Arbitrary file deletion
  • CVEs: CVE-2020-3808

SecPod Saner detects these vulnerabilities and hence automatically fixes them by applying security updates. Therefore, Download SanerNow and keep your systems updated and secure.

Featured Posts

Open Citrix Sounds the Alarm: Two Critical NetScaler Zero-Days Actively Exploited
Citrix Sounds the Alarm: Two Critical NetScaler Zero-Days Actively Exploited

CVE Research

Citrix Sounds the Alarm: Two Critical NetScaler Zero-Days Actively Exploited

Citrix has released security updates for NetScaler ADC and NetScaler Gateway addressing CVE-2026-88771 and CVE-2026-88772, two critical remote code execution vulnerabilities. Exploits against unmitigated deployments have been observed. CVE-2026-88771 affects all deployments, including default configurations; CVE-2026-88772 applies when DTLS is enabled, including the default state on VPN virtual servers. This article covers impact, affected and fixed versions, how to confirm exposure, and recommended remediation.

Sep 28, 2026

Open CVE-2023-49105: The ownCloud Authentication Flaw That Exposed Sensitive Credentials
CVE-2023-49105: The ownCloud Authentication Flaw That Exposed Sensitive Credentials

CVE Research

CVE-2023-49105: The ownCloud Authentication Flaw That Exposed Sensitive Credentials

Sep 25, 2026

Open Patch Analysis & Exploitation Timeline: RouterOS SSH Attacks Predate Production Fixes in CISA's September 10, 2026 KEV Additions
Patch Analysis & Exploitation Timeline: RouterOS SSH Attacks Predate Production Fixes in CISA's September 10, 2026 KEV Additions

CVE Research

Patch Analysis & Exploitation Timeline: RouterOS SSH Attacks Predate Production Fixes in CISA's September 10, 2026 KEV Additions

Two MikroTik RouterOS CVEs entered CISA KEV seven days after production fixes. Dated reporting places SSH-chain exploitation involving CVE-2026-86060 at least one calendar day before those releases; no comparable start date is established for CVE-2026-67277.

Sep 25, 2026

Open Patch Analysis & Exploitation Timeline: A Day-Old Chrome Bug and an Eight-Month-Old Fortinet Flaw Share the Same KEV Batch
Patch Analysis & Exploitation Timeline: A Day-Old Chrome Bug and an Eight-Month-Old Fortinet Flaw Share the Same KEV Batch

CVE Research

Patch Analysis & Exploitation Timeline: A Day-Old Chrome Bug and an Eight-Month-Old Fortinet Flaw Share the Same KEV Batch

Four vulnerabilities added to CISA’s KEV catalog on September 9, 2026 show widely different timelines between public disclosure and formal exploitation-based prioritization, ranging from one day to 239 days.

Sep 24, 2026