SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Apple Security Updates March 2020 and Adobe Creative Cloud Critical Security Update

Apple finally released Security Updates in March 2020 for multiple products today. A total of 49 vulnerabilities were addressed. However, Exploiting some of these security flaws could allow an attacker to take control of an affected system. Hence, Vulnerability Management System is the solution to t

Mar 26, 20206 min read

Apple finally released Security Updates in March 2020 for multiple products today. A total of 49 vulnerabilities were addressed. However, Exploiting some of these security flaws could allow an attacker to take control of an affected system. Hence, Vulnerability Management System is the solution to these problems. Adobe also released an out-of-band security update for critical arbitrary file deletion vulnerability in Creative Cloud. Therefore, a good Vulnerability Management Software can prevent these attacks.

Critical vulnerabilities in Apple products

The update for macOS includes fixes for 27 vulnerabilities, which could finally allow an attacker to execute arbitrary code with kernel privileges, disclose sensitive information, escalate privileges, cause memory corruption, etc.

A total of 11 vulnerabilities have been fixed in Apple Safari. Moreover, Arbitrary code execution or cross-site scripting attacks could be carried out using maliciously crafted web content, and an application may be able to read restricted memory. Finally, Apple fixed this issue by including additional validations.

A type of confusion issue was present in Apple iTunes, which could be used to process maliciously crafted web content leading to arbitrary code execution. Hence, this vulnerability was addressed with improved memory handling.

Therefore, a race condition issue was addressed in Apple iCloud for Windows 7 and Windows 10 through Windows Store. Moreover, Successful exploitation may allow an application to read restricted memory.

Critical security update for Adobe Creative Cloud

The time-of-check to time-of-use (TOCTOU) race condition vulnerability is regarded as critical in severity and can result in arbitrary file deletion. Hence, a Creative Cloud is a set of applications and services from Adobe Inc. A user can subscribe and can get access to a collection of software such as Adobe Photoshop, Adobe Premiere Pro, After Effects, etc. which can be in use for graphic design, video editing, photography, and various other applications.

However, this vulnerability which allows an attacker to delete arbitrary files, occurs due to a race condition, i.e., when two or more systems or processes access shared resources and intend to modify the data. Hence, the time-of-check to time-of-use race condition checks for the specified resources and, at the same time, uses the result from the resource check performed. Therefore, an attacker can delete arbitrary files on the target system if successfully exploited.

Adobe has finally released updates to fix this vulnerability. Hence, We strongly recommend installing these security updates as soon as possible.

Apple Security Updates Summary for March 2020 and Adobe Creative Cloud Out-of-Band Security Update:

macOS

  • Affected OS: macOS Catalina, Mojave, and High SierraAffected features: HSSPI Support, AppleGraphicsControl, AppleMobileFileIntegrity, Bluetooth, Call History, CoreFoundation, FaceTime, Icons, Intel Graphics Driver, IOHIDFamily, IOThunderboltFamily, Kernel, libxml2, Mail, sudo, TCC, Time Machine, VimImpact: Information Disclosure, Privilege Escalation, arbitrary code execution, memory corruption
  • CVEs: CVE-2019-14615, CVE-2019-19232, CVE-2019-8853, CVE-2020-3851, CVE-2020-3881, CVE-2020-3883, CVE-2020-3884, CVE-2020-3889, CVE-2020-3892, CVE-2020-3893, CVE-2020-3903, CVE-2020-3904, CVE-2020-3905, CVE-2020-3906, CVE-2020-3907, CVE-2020-3908, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-3912, CVE-2020-3913, CVE-2020-3914, CVE-2020-3919, CVE-2020-9769, CVE-2020-9773, CVE-2020-9776, CVE-2020-9785

Safari

  • Affected OS: macOS Mojave, macOS High Sierra, and macOS Catalina
  • Affected features: Safari Downloads, WebKit, WebKit Page Loading
  • Impact: Information Disclosure, Cross-Site scripting, Incorrect file URL processing, Arbitrary code execution
  • CVEs: CVE-2020-3885, CVE-2020-3887, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9783, CVE-2020-9784

iTunes

  • Affected OS: Windows 7 and later
  • Affected features: libxml2, WebKit, WebKit Page Loading
  • Impact: Incorrect file URL processing, Cross-Site scripting, Arbitrary code execution
  • CVEs: CVE-2020-3885, CVE-2020-3887, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-9783

tvOS

  • Affected OS: Apple TV 4K and Apple TV HD
  • Affected features: ActionKit, AppleMobileFileIntegrity, Icons, Image Processing, IOHIDFamily, Kernel, libxml2, WebKit, WebKit Page Loading
  • Impact: Information Disclosure, Incorrect file URL processing, Arbitrary Code Execution, Privilege Escalation
  • CVEs: CVE-2020-3883, CVE-2020-3885, CVE-2020-3887, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-3914, CVE-2020-3917, CVE-2020-3919, CVE-2020-9768, CVE-2020-9773, CVE-2020-9783, CVE-2020-9785

watchOS

  • Affected OS: watchOS
  • Affected features: ActionKit, AppleMobileFileIntegrity, CoreFoundation, Icons, Image Processing, IOHIDFamily, Kernel, libxml2, Messages, WebKit
  • Impact: Arbitrary Code Execution, Privilege Escalation, Information Disclosure
  • CVEs: CVE-2020-3883, CVE-2020-3891, CVE-2020-3895, CVE-2020-3897, CVE-2020-3900, CVE-2020-3901, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-3913, CVE-2020-3914, CVE-2020-3916, CVE-2020-3917, CVE-2020-3919, CVE-2020-9768, CVE-2020-9773, CVE-2020-9785

iOS and iPadOS

  • Affected OS: iOS and iPad
  • Affected features: ActionKit, Bluetooth, AppleMobileFileIntegrity, CoreFoundation, Icons, Image Processing, IOHIDFamily, Kernel, libxml2, Mail, Mail Attachments, Messages, Messages Composition, Safari, Web App, WebKit, WebKit Page Loading
  • Impact: Arbitrary Code Execution, Privilege Escalation, Information Disclosure
  • CVEs: CVE-2020-3883, CVE-2020-3885, CVE-2020-3887, CVE-2020-3888, CVE-2020-3890, CVE-2020-3891, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-3913, CVE-2020-3914, CVE-2020-3916, CVE-2020-3917, CVE-2020-3919, CVE-2020-9768, CVE-2020-9770, CVE-2020-9773, CVE-2020-9775, CVE-2020-9777, CVE-2020-9780, CVE-2020-9781, CVE-2020-9783, CVE-2020-9785

iCloud

  • Product: iCloud
  • Affected OS: Windows 7 and Windows 10
  • Affected features: libxml2, WebKit, WebKit Page Loading
  • Impact: Arbitrary Code Execution, Cross-Site scripting, Incorrect file URL processing
  • CVEs: CVE-2020-3885, CVE-2020-3887, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-3909, CVE-2020-3910, CVE-2020-3911, CVE-2020-9783

Adobe Creative Cloud

  • Product: Adobe Creative Cloud 5.0 and earlier versions
  • Affected OS : Windows
  • Impact: Arbitrary file deletion
  • CVEs: CVE-2020-3808

SecPod Saner detects these vulnerabilities and hence automatically fixes them by applying security updates. Therefore, Download SanerNow and keep your systems updated and secure.

Featured Posts

Open Threats exploiting CISA KEV-listed CVEs: April to September 2026
threat intelligenceThreats exploiting CISA KEV-listed CVEs: April to September 2026

CVE Research

Threats exploiting CISA KEV-listed CVEs: April to September 2026

Oct 22, 2026

Open PHP2Shell: Two Critical Core PHP Flaws Enable Unauthenticated RCE Across the Web
vulnerability researchPHP2Shell: Two Critical Core PHP Flaws Enable Unauthenticated RCE Across the Web

CVE Research

PHP2Shell: Two Critical Core PHP Flaws Enable Unauthenticated RCE Across the Web

PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets unauthenticated attackers execute code or read server memory through two critical flaws in PHP’s core runtime, affecting nearly every version since PHP 5.4 and triggering active exploitation attempts within hours of patch release.

Oct 22, 2026

Open F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws
vulnerability researchF5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

CVE Research

F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

Oct 19, 2026

Open Silent Lynx Hits CIS Governments With WinRAR Flaw
threat intelligenceSilent Lynx Hits CIS Governments With WinRAR Flaw

CVE Research

Silent Lynx Hits CIS Governments With WinRAR Flaw

Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.

Oct 16, 2026