About the security content of Security Update 2021-003 Catalina

This document describes the security content of Security Update 2021-003 Catalina.

About Apple security updates

For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

Security Update 2021-003 Catalina

Released May 24, 2021

AMD

Available for: macOS Catalina

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: A logic issue was addressed with improved state management.

CVE-2021-30676: shrek_wzw

AMD

Available for: macOS Catalina

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: A logic issue was addressed with improved state management.

CVE-2021-30678: Yu Wang of Didi Research America

App Store

Available for: macOS Catalina

Impact: A path handling issue was addressed with improved validation

Description: A malicious application may be able to break out of its sandbox.

CVE-2021-30688: Thijs Alkemade of Computest Research Division

Entry added July 21, 2021

AppleScript

Available for: macOS Catalina

Impact: A malicious application may bypass Gatekeeper checks

Description: A logic issue was addressed with improved state management.

CVE-2021-30669: Yair Hoffman

Audio

Available for: macOS Catalina

Impact: Parsing a maliciously crafted audio file may lead to disclosure of user information

Description: This issue was addressed with improved checks.

CVE-2021-30685: Mickey Jin (@patch1t) of Trend Micro

CoreAudio

Available for: macOS Catalina

Impact: An out-of-bounds read was addressed with improved bounds checking

Description: Processing a maliciously crafted audio file may disclose restricted memory.

CVE-2021-30686: Mickey Jin of Trend Micro working with Trend Micro Zero Day Initiative

Entry added July 21, 2021

Core Services

Available for: macOS Catalina

Impact: A malicious application may be able to gain root privileges

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2021-30681: Zhongcheng Li (CK01)

CVMS

Available for: macOS Catalina

Impact: A local attacker may be able to elevate their privileges

Description: This issue was addressed with improved checks.

CVE-2021-30724: Mickey Jin (@patch1t) of Trend Micro

Dock

Available for: macOS Catalina

Impact: A malicious application may be able to access a user’s call history

Description: An access issue was addressed with improved access restrictions.

CVE-2021-30673: Josh Parnham (@joshparnham)

FontParser

Available for: macOS Catalina

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved state management.

CVE-2020-29629: an anonymous researcher

Entry added May 25, 2022

FontParser

Available for: macOS Catalina

Impact: A malicious application may be able to read restricted memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-29629: an anonymous researcher

Entry added May 25, 2022

Graphics Drivers

Available for: macOS Catalina

Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution

Description: A logic issue was addressed with improved state management.

CVE-2021-30684: Liu Long of Ant Security Light-Year Lab

Graphics Drivers

Available for: macOS Catalina

Impact: An out-of-bounds write issue was addressed with improved bounds checking

Description: A malicious application may be able to execute arbitrary code with kernel privileges.

CVE-2021-30735: Jack Dates of RET2 Systems, Inc. (@ret2systems) working with Trend Micro Zero Day Initiative

Entry added July 21, 2021

Heimdal

Available for: macOS Catalina

Impact: A malicious application may cause a denial of service or potentially disclose memory contents

Description: A memory corruption issue was addressed with improved state management.

CVE-2021-30710: Gabe Kirkpatrick (@gabe_k)

Heimdal

Available for: macOS Catalina

Impact: A remote attacker may be able to cause a denial of service

Description: A race condition was addressed with improved locking.

CVE-2021-1884: Gabe Kirkpatrick (@gabe_k)

Heimdal

Available for: macOS Catalina

Impact: Processing maliciously crafted server messages may lead to heap corruption

Description: This issue was addressed with improved checks.

CVE-2021-1883: Gabe Kirkpatrick (@gabe_k)

Heimdal

Available for: macOS Catalina

Impact: A local user may be able to leak sensitive user information

Description: A logic issue was addressed with improved state management.

CVE-2021-30697: Gabe Kirkpatrick (@gabe_k)

Heimdal

Available for: macOS Catalina

Impact: A malicious application could execute arbitrary code leading to compromise of user information

Description: A use after free issue was addressed with improved memory management.

CVE-2021-30683: Gabe Kirkpatrick (@gabe_k)

ImageIO

Available for: macOS Catalina

Impact: Processing a maliciously crafted image may lead to disclosure of user information

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-30687: Hou JingYi (@hjy79425575) of Qihoo 360

ImageIO

Available for: macOS Catalina

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: This issue was addressed with improved checks.

CVE-2021-30701: Mickey Jin (@patch1t) of Trend Micro and Ye Zhang of Baidu Security

ImageIO

Available for: macOS Catalina

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds write was addressed with improved input validation.

CVE-2021-30743: CFF of Topsec Alpha Team, an anonymous researcher, and Jeonghoon Shin(@singi21a) of THEORI working with Trend Micro Zero Day Initiative

ImageIO

Available for: macOS Catalina

Impact: Processing a maliciously crafted ASTC file may disclose memory contents

Description: This issue was addressed with improved checks.

CVE-2021-30705: Ye Zhang of Baidu Security

Intel Graphics Driver

Available for: macOS Catalina

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2021-30728: Liu Long of Ant Security Light-Year Lab

Intel Graphics Driver

Available for: macOS Catalina

Impact: An out-of-bounds read issue was addressed by removing the vulnerable code

Description: A local user may be able to cause unexpected system termination or read kernel memory.

CVE-2021-30719: an anonymous researcher working with Trend Micro Zero Day Initiative

Entry added July 21, 2021

Intel Graphics Driver

Available for: macOS Catalina

Impact: An out-of-bounds write issue was addressed with improved bounds checking

Description: A malicious application may be able to execute arbitrary code with kernel privileges.

CVE-2021-30726: Yinyi Wu(@3ndy1) of Qihoo 360 Vulcan Team

Entry added July 21, 2021

Kernel

Available for: macOS Catalina

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A logic issue was addressed with improved state management.

CVE-2021-30704: an anonymous researcher

Kernel

Available for: macOS Catalina

Impact: Processing a maliciously crafted message may lead to a denial of service

Description: A logic issue was addressed with improved state management.

CVE-2021-30715: The UK’s National Cyber Security Centre (NCSC)

Kernel

Available for: macOS Catalina

Impact: A memory corruption issue was addressed with improved validation

Description: A local attacker may be able to elevate their privileges.

CVE-2021-30739: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab

Entry added July 21, 2021

Login Window

Available for: macOS Catalina

Impact: A person with physical access to a Mac may be able to bypass Login Window

Description: A logic issue was addressed with improved state management.

CVE-2021-30702: Jewel Lambert of Original Spin, LLC.

Mail

Available for: macOS Catalina

Impact: A logic issue was addressed with improved state management

Description: An attacker in a privileged network position may be able to misrepresent application state.

CVE-2021-30696: Fabian Ising and Damian Poddebniak of Münster University of Applied Sciences

Entry added July 21, 2021

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted USD file may disclose memory contents

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-30819

Entry added May 25, 2022

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted USD file may disclose memory contents

Description: An information disclosure issue was addressed with improved state management.

CVE-2021-30723: Mickey Jin (@patch1t) of Trend Micro

CVE-2021-30691: Mickey Jin (@patch1t) of Trend Micro

CVE-2021-30694: Mickey Jin (@patch1t) of Trend Micro

CVE-2021-30692: Mickey Jin (@patch1t) of Trend Micro

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted USD file may disclose memory contents

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-30746: Mickey Jin (@patch1t) of Trend Micro

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: A validation issue was addressed with improved logic.

CVE-2021-30693: Mickey Jin (@patch1t) & Junzhi Lu (@pwn0rz) of Trend Micro

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted USD file may disclose memory contents

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-30695: Mickey Jin (@patch1t) & Junzhi Lu (@pwn0rz) of Trend Micro

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-30708: Mickey Jin (@patch1t) & Junzhi Lu (@pwn0rz) of Trend Micro

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted USD file may disclose memory contents

Description: This issue was addressed with improved checks.

CVE-2021-30709: Mickey Jin (@patch1t) of Trend Micro

Model I/O

Available for: macOS Catalina

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: A memory corruption issue was addressed with improved state management.

CVE-2021-30725: Mickey Jin (@patch1t) of Trend Micro

NSOpenPanel

Available for: macOS Catalina

Impact: An application may be able to gain elevated privileges

Description: This issue was addressed by removing the vulnerable code.

CVE-2021-30679: Gabe Kirkpatrick (@gabe_k)

OpenLDAP

Available for: macOS Catalina

Impact: A remote attacker may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2020-36226

CVE-2020-36229

CVE-2020-36225

CVE-2020-36224

CVE-2020-36223

CVE-2020-36227

CVE-2020-36228

CVE-2020-36221

CVE-2020-36222

CVE-2020-36230

Security

Available for: macOS Catalina

Impact: A memory corruption issue in the ASN.1 decoder was addressed by removing the vulnerable code

Description: Processing a maliciously crafted certificate may lead to arbitrary code execution.

CVE-2021-30737: xerub

Entry added July 21, 2021

smbx

Available for: macOS Catalina

Impact: An attacker in a privileged network position may be able to perform denial of service

Description: A logic issue was addressed with improved state management.

CVE-2021-30716: Aleksandar Nikolic of Cisco Talos

smbx

Available for: macOS Catalina

Impact: An attacker in a privileged network position may be able to execute arbitrary code

Description: A memory corruption issue was addressed with improved state management.

CVE-2021-30717: Aleksandar Nikolic of Cisco Talos

smbx

Available for: macOS Catalina

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: A logic issue was addressed with improved state management.

CVE-2021-30712: Aleksandar Nikolic of Cisco Talos

smbx

Available for: macOS Catalina

Impact: An attacker in a privileged network position may be able to leak sensitive user information

Description: A path handling issue was addressed with improved validation.

CVE-2021-30721: Aleksandar Nikolic of Cisco Talos

smbx

Available for: macOS Catalina

Impact: An attacker in a privileged network position may be able to leak sensitive user information

Description: An information disclosure issue was addressed with improved state management.

CVE-2021-30722: Aleksandar Nikolic of Cisco Talos

TCC

Available for: macOS Catalina

Impact: A malicious application may be able to send unauthorized Apple events to Finder

Description: A validation issue was addressed with improved logic.

CVE-2021-30671: Ryan Bell (@iRyanBell)

Additional recognition

App Store

We would like to acknowledge Thijs Alkemade of Computest Research Division for their assistance.

CFString

We would like to acknowledge an anonymous researcher for their assistance.

CoreCapture

We would like to acknowledge Zuozhi Fan (@pattern_F_) of Ant-financial TianQiong Security Lab for their assistance.

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: November 03, 2023