Apple Macos

Copied files may not have the expected file permissions

CVE-2021-1832 5.5 - Medium - September 08, 2021

Copied files may not have the expected file permissions. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. The issue was addressed with improved permissions logic.

Incorrect Default Permissions

A type confusion issue was addressed with improved state handling

CVE-2021-1829 9.8 - Critical - September 08, 2021

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.3. An application may be able to execute arbitrary code with kernel privileges.

Object Type Confusion

The issue was addressed with improved permissions logic

CVE-2021-1839 7.8 - High - September 08, 2021

The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. A local attacker may be able to elevate their privileges.

Improper Privilege Management

An out-of-bounds write issue was addressed with improved bounds checking

CVE-2021-1834 9.8 - Critical - September 08, 2021

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. A malicious application may be able to execute arbitrary code with kernel privileges.

Memory Corruption

A parsing issue in the handling of directory paths was addressed with improved path validation

CVE-2021-1740 5.5 - Medium - September 08, 2021

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local user may be able to modify protected parts of the file system.

Directory traversal

A parsing issue in the handling of directory paths was addressed with improved path validation

CVE-2021-1739 5.5 - Medium - September 08, 2021

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local user may be able to modify protected parts of the file system.

Directory traversal

A memory corruption issue was addressed with improved validation

CVE-2021-1840 7.8 - High - September 08, 2021

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. A local attacker may be able to elevate their privileges.

Improper Input Validation

An out-of-bounds write was addressed with improved input validation

CVE-2021-1762 7.8 - High - September 08, 2021

An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.

Memory Corruption

A local user may be able to cause unexpected system termination or read kernel memory

CVE-2021-30719 7.1 - High - September 08, 2021

A local user may be able to cause unexpected system termination or read kernel memory. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. An out-of-bounds read issue was addressed by removing the vulnerable code.

Out-of-bounds Read

This issue was addressed with improved checks

CVE-2021-30718 4.3 - Medium - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4. A non-privileged user may be able to modify restricted settings.

A memory corruption issue was addressed with improved state management

CVE-2021-30717 8.1 - High - September 08, 2021

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An attacker in a privileged network position may be able to execute arbitrary code.

Memory Corruption

A logic issue was addressed with improved state management

CVE-2021-30716 5.9 - Medium - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An attacker in a privileged network position may be able to perform denial of service.

A logic issue was addressed with improved restrictions

CVE-2021-1826 6.1 - Medium - September 08, 2021

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to universal cross site scripting.

XSS

An input validation issue was addressed with improved input validation

CVE-2021-1825 6.1 - Medium - September 08, 2021

An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting attack.

XSS

This issue was addressed with improved entitlements

CVE-2021-1824 4.4 - Medium - September 08, 2021

This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application with root privileges may be able to access private information.

Exposure of Resource to Wrong Sphere

A buffer overflow may result in arbitrary code execution

CVE-2021-1770 9.8 - Critical - September 08, 2021

A buffer overflow may result in arbitrary code execution. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A logic issue was addressed with improved state management.

Buffer Overflow

A logic issue was addressed with improved state management

CVE-2021-30715 7.5 - High - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. Processing a maliciously crafted message may lead to a denial of service.

A permissions issue was addressed with improved validation

CVE-2021-30713 7.8 - High - September 08, 2021

A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..

AuthZ

A logic issue was addressed with improved state management

CVE-2021-30712 7.8 - High - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.

A logic issue was addressed with improved state management

CVE-2021-30702 4.6 - Medium - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A person with physical access to a Mac may be able to bypass Login Window.

authentification

A logic issue was addressed with improved state management

CVE-2021-30669 5.5 - Medium - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A malicious application may bypass Gatekeeper checks.

Download of Code Without Integrity Check

A logic issue was addressed with improved state management

CVE-2021-1853 7.8 - High - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3. A local attacker may be able to elevate their privileges.

Improper Privilege Management

A memory corruption issue was addressed with improved validation

CVE-2021-1847 7.8 - High - September 08, 2021

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

Memory Corruption

This issue was addressed with improved checks

CVE-2021-1843 7.8 - High - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing a maliciously crafted image may lead to arbitrary code execution.

A memory corruption issue was addressed with improved validation

CVE-2021-1828 7.1 - High - September 08, 2021

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. An application may be able to cause unexpected system termination or write kernel memory.

Memory Corruption

A memory initialization issue was addressed with improved memory handling

CVE-2021-1820 6.5 - Medium - September 08, 2021

A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may result in the disclosure of process memory.

Exposure of Resource to Wrong Sphere

A memory corruption issue was addressed with improved state management

CVE-2021-1817 8.8 - High - September 08, 2021

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to arbitrary code execution.

Memory Corruption

A parsing issue in the handling of directory paths was addressed with improved path validation

CVE-2021-1815 5.5 - Medium - September 08, 2021

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A local user may be able to modify protected parts of the file system.

Directory traversal

A logic issue was addressed with improved state management

CVE-2021-1811 6.5 - Medium - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.11.3 for Windows, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iCloud for Windows 12.3, macOS Big Sur 11.3, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing a maliciously crafted font may result in the disclosure of process memory.

A logic issue was addressed with improved state management

CVE-2021-1810 9.8 - Critical - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks.

A memory corruption issue was addressed with improved validation

CVE-2021-1809 7.5 - High - September 08, 2021

A memory corruption issue was addressed with improved validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A malicious application may be able to read restricted memory.

Out-of-bounds Read

A memory corruption issue was addressed with improved validation

CVE-2021-1808 7.5 - High - September 08, 2021

A memory corruption issue was addressed with improved validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. An application may be able to read restricted memory.

Out-of-bounds Read

A permissions issue existed in DiskArbitration

CVE-2021-1784 7.5 - High - September 08, 2021

A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. A malicious application may be able to modify protected parts of the file system.

Incorrect Permission Assignment for Critical Resource

A memory corruption issue was addressed with improved state management

CVE-2021-30710 7.1 - High - September 08, 2021

A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. A malicious application may cause a denial of service or potentially disclose memory contents.

Memory Corruption

This issue was addressed with improved checks

CVE-2021-30709 5.5 - Medium - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.

Exposure of Resource to Wrong Sphere

An out-of-bounds read was addressed with improved input validation

CVE-2021-30708 7.8 - High - September 08, 2021

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.

Out-of-bounds Read

This issue was addressed with improved checks

CVE-2021-30707 8.8 - High - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted audio file may lead to arbitrary code execution.

Classic Buffer Overflow

This issue was addressed with improved environment sanitization

CVE-2021-30677 8.8 - High - September 08, 2021

This issue was addressed with improved environment sanitization. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to break out of its sandbox.

A logic issue was addressed with improved state management

CVE-2021-30676 7.1 - High - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A local user may be able to cause unexpected system termination or read kernel memory.

An access issue was addressed with improved access restrictions

CVE-2021-30673 5.5 - Medium - September 08, 2021

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A malicious application may be able to access a user's call history.

Exposure of Resource to Wrong Sphere

A memory corruption issue was addressed with improved state management

CVE-2021-30672 7.8 - High - September 08, 2021

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. A malicious application may be able to gain root privileges.

Memory Corruption

This issue was addressed with improved checks

CVE-2021-30668 4.6 - Medium - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4. A person with physical access to a Mac may be able to bypass Login Window during a software update.

authentification

A memory corruption issue was addressed with improved state management

CVE-2021-30665 8.8 - High - September 08, 2021

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Buffer Overflow

Processing a maliciously crafted image may lead to arbitrary code execution

CVE-2021-1858 8.8 - High - September 08, 2021

Processing a maliciously crafted image may lead to arbitrary code execution. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. An out-of-bounds write issue was addressed with improved bounds checking.

Memory Corruption

A memory initialization issue was addressed with improved memory handling

CVE-2021-1857 6.5 - Medium - September 08, 2021

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iTunes 12.11.3 for Windows, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iCloud for Windows 12.3, macOS Big Sur 11.3, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may disclose sensitive user information.

Improper Initialization

A validation issue was addressed with improved logic

CVE-2021-1813 7.8 - High - September 08, 2021

A validation issue was addressed with improved logic. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A malicious application may be able to gain root privileges.

Improper Privilege Management

An integer overflow was addressed with improved input validation

CVE-2021-30663 8.8 - High - September 08, 2021

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.

Integer Overflow or Wraparound

A race condition was addressed with improved locking

CVE-2021-1884 5.9 - Medium - September 08, 2021

A race condition was addressed with improved locking. This issue is fixed in Security Update 2021-004 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, Security Update 2021-003 Catalina, tvOS 14.5, macOS Big Sur 11.3. A remote attacker may be able to cause a denial of service.

Race Condition

A double free issue was addressed with improved memory management

CVE-2021-1875 7.8 - High - September 08, 2021

A double free issue was addressed with improved memory management. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing a maliciously crafted file may lead to heap corruption.

Double-free

A logic issue was addressed with improved state management

CVE-2021-30798 7.5 - High - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6. A malicious application may be able to bypass certain Privacy preferences.

Exposure of Resource to Wrong Sphere

This issue was addressed with improved checks

CVE-2021-30797 8.8 - High - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to code execution.

A stack overflow was addressed with improved input validation

CVE-2021-30759 7.8 - High - September 08, 2021

A stack overflow was addressed with improved input validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-005 Mojave, Security Update 2021-004 Catalina. Processing a maliciously crafted font file may lead to arbitrary code execution.

Memory Corruption

A type confusion issue was addressed with improved state handling

CVE-2021-30758 8.8 - High - September 08, 2021

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to arbitrary code execution.

Object Type Confusion

Multiple memory corruption issues were addressed with improved memory handling

CVE-2021-30799 8.8 - High - September 08, 2021

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Processing maliciously crafted web content may lead to arbitrary code execution.

Memory Corruption

An information disclosure issue was addressed by removing the vulnerable code

CVE-2021-30790 7.8 - High - September 08, 2021

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

Information Disclosure

An out-of-bounds read was addressed with improved input validation

CVE-2021-30789 7.8 - High - September 08, 2021

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-004 Catalina. Processing a maliciously crafted font file may lead to arbitrary code execution.

Out-of-bounds Read

A memory corruption issue was addressed with improved state management

CVE-2021-30775 7.8 - High - September 08, 2021

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-004 Catalina. Processing a maliciously crafted audio file may lead to arbitrary code execution.

Memory Corruption

This issue was addressed with improved checks

CVE-2021-30772 7.8 - High - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.5. A malicious application may be able to gain root privileges.

Improper Privilege Management

Processing a maliciously crafted font may result in the disclosure of process memory

CVE-2021-30753 5.5 - Medium - September 08, 2021

Processing a maliciously crafted font may result in the disclosure of process memory. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. An out-of-bounds read was addressed with improved input validation.

Out-of-bounds Read

A logic issue was addressed with improved state management

CVE-2021-30793 9.8 - Critical - September 08, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges.

This issue was addressed with improved checks

CVE-2021-30788 7.1 - High - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-005 Mojave, Security Update 2021-004 Catalina. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents.

This issue was addressed with improved checks

CVE-2021-30787 7.8 - High - September 08, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to cause unexpected system termination or write kernel memory.

Processing a maliciously crafted font may result in the disclosure of process memory

CVE-2021-30755 6.5 - Medium - September 08, 2021

Processing a maliciously crafted font may result in the disclosure of process memory. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5. An out-of-bounds read was addressed with improved input validation.

Out-of-bounds Read

A buffer overflow was addressed with improved bounds checking

CVE-2021-30785 7.8 - High - September 08, 2021

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-004 Catalina. Processing a maliciously crafted image may lead to arbitrary code execution.

Classic Buffer Overflow

A logic issue was addressed with improved validation

CVE-2021-30774 7.8 - High - September 08, 2021

A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. A malicious application may be able to gain root privileges.

An out-of-bounds write was addressed with improved input validation

CVE-2021-30766 7.8 - High - September 08, 2021

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges.

Memory Corruption

An out-of-bounds write was addressed with improved input validation

CVE-2021-30765 7.8 - High - September 08, 2021

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges.

Memory Corruption

An integer overflow was addressed through improved input validation

CVE-2021-30760 7.8 - High - September 08, 2021

An integer overflow was addressed through improved input validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-005 Mojave, Security Update 2021-004 Catalina. Processing a maliciously crafted font file may lead to arbitrary code execution.

Integer Overflow or Wraparound

A local attacker may be able to view Now Playing information from the lock screen

CVE-2021-30756 5.5 - Medium - September 08, 2021

A local attacker may be able to view Now Playing information from the lock screen. This issue is fixed in macOS Big Sur 11.4, iOS 14.6 and iPadOS 14.6. A privacy issue in Now Playing was addressed with improved permissions.

Information Disclosure

A memory corruption issue was addressed with improved input validation

CVE-2021-30805 9.8 - Critical - September 08, 2021

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges.

Memory Corruption

A logic issue was addressed with improved validation

CVE-2021-30796 6.5 - Medium - September 08, 2021

A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Processing a maliciously crafted image may lead to a denial of service.

A use after free issue was addressed with improved memory management

CVE-2021-30795 8.8 - High - September 08, 2021

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to arbitrary code execution.

Dangling pointer

An integer overflow was addressed with improved input validation

CVE-2021-30860 7.8 - High - August 24, 2021

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Integer Overflow or Wraparound

A use after free issue was addressed with improved memory management

CVE-2021-30858 8.8 - High - August 24, 2021

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Dangling pointer

A flaw was found in OpenLDAP

CVE-2020-25709 7.5 - High - May 18, 2021

A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAPs slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.

assertion failure

A logic issue was addressed with improved state management

CVE-2021-1802 7.8 - High - April 02, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. A local attacker may be able to elevate their privileges.

Improper Privilege Management

The issue was addressed with improved permissions logic

CVE-2021-1803 3.3 - Low - April 02, 2021

The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A local application may be able to enumerate the user's iCloud documents.

An out-of-bounds write was addressed with improved input validation

CVE-2021-1805 7.8 - High - April 02, 2021

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, macOS Mojave 10.14.6 Security Update 2021-002. An application may be able to execute arbitrary code with kernel privileges.

Memory Corruption

A logic issue was addressed with improved state management

CVE-2021-1818 9.8 - Critical - April 02, 2021

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.

A race condition was addressed with additional validation

CVE-2021-1806 7 - High - April 02, 2021

A race condition was addressed with additional validation. This issue is fixed in macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, macOS Mojave 10.14.6 Security Update 2021-002. An application may be able to execute arbitrary code with kernel privileges.

Race Condition

A logic issue was addressed with improved restrictions

CVE-2021-1870 9.8 - Critical - April 02, 2021

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

A logic issue was addressed with improved restrictions

CVE-2021-1871 9.8 - Critical - April 02, 2021

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

An out-of-bounds read was addressed with improved input validation

CVE-2021-1790 7.8 - High - April 02, 2021

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Processing a maliciously crafted font may lead to arbitrary code execution.

Out-of-bounds Read

An out-of-bounds read was addressed with improved bounds checking

CVE-2021-1753 7.8 - High - April 02, 2021

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.

Out-of-bounds Read

This issue was addressed with improved checks

CVE-2021-1761 7.5 - High - April 02, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause a denial of service.

This issue was addressed with improved checks

CVE-2021-1793 7.8 - High - April 02, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.

The issue was addressed with improved permissions logic

CVE-2021-1797 5.5 - Medium - April 02, 2021

The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to read arbitrary files.

A port redirection issue was addressed with additional port validation

CVE-2021-1799 6.5 - Medium - April 02, 2021

A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on arbitrary servers.

This issue was addressed with improved iframe sandbox enforcement

CVE-2021-1801 6.5 - Medium - April 02, 2021

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.

A memory corruption issue was addressed with improved validation

CVE-2021-1844 8.8 - High - April 02, 2021

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3. Processing maliciously crafted web content may lead to arbitrary code execution.

Buffer Overflow

A logic issue was addressed with improved restrictions

CVE-2020-10008 5.5 - Medium - April 02, 2021

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.0.1. A malicious application with root privileges may be able to access private information.

An issue existed in screen sharing

CVE-2020-27893 6.5 - Medium - April 02, 2021

An issue existed in screen sharing. This issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. A user with screen sharing access may be able to view another user's screen.

A use after free issue was addressed with improved memory management

CVE-2020-27899 7.8 - High - April 02, 2021

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.2 and iPadOS 14.2, macOS Big Sur 11.0.1, watchOS 7.1, tvOS 14.2. A local attacker may be able to elevate their privileges.

Dangling pointer

A logic issue was addressed with improved restrictions

CVE-2020-27901 6.3 - Medium - April 02, 2021

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. A sandboxed process may be able to circumvent sandbox restrictions.

AuthZ

A logic issue was addressed with improved restrictions

CVE-2020-27901 6.3 - Medium - April 02, 2021

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. A sandboxed process may be able to circumvent sandbox restrictions.

AuthZ

A memory corruption issue was addressed with improved memory handling

CVE-2020-27907 7.8 - High - April 02, 2021

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.

Buffer Overflow

A memory corruption issue was addressed with improved memory handling

CVE-2020-27907 7.8 - High - April 02, 2021

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.

Buffer Overflow

A memory corruption issue existed in the processing of font files

CVE-2020-27943 7.8 - High - April 02, 2021

A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in tvOS 14.3, iOS 14.3 and iPadOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.2. Processing a maliciously crafted font file may lead to arbitrary code execution.

Buffer Overflow

A memory corruption issue existed in the processing of font files

CVE-2020-27944 7.8 - High - April 02, 2021

A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in watchOS 7.2, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. Processing a maliciously crafted font file may lead to arbitrary code execution.

Buffer Overflow

This issue was addressed with improved checks

CVE-2020-27939 7.8 - High - April 02, 2021

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. Processing a maliciously crafted image may lead to arbitrary code execution.