CVE-2020-3916

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. Setting an alternate app icon may disclose a photo without needing permission to access photos.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Apple	iOS	>= unspecified, < iOS 13.4 and iPadOS 13.4
Apple	watchOS	>= unspecified, < watchOS 6.2

References

https://support.apple.com/HT211102Vendor Advisory
https://support.apple.com/HT211103Vendor Advisory
https://support.apple.com/HT211102Vendor Advisory
https://support.apple.com/HT211103Vendor Advisory

Timeline

Published: Apr 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-39175.5This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application may CVE-2020-39185.5An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4,CVE-2020-39197.8A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 1 CVE-2020-39208.1UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can CVE-2020-39217.5UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a speci CVE-2020-39229.8LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation.CVE-2020-39239.8DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crac CVE-2020-39249.8DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific CVE-2020-39258.8A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is CVE-2020-39267.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they m CVE-2020-39277.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they m CVE-2020-39289.8GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.