Input validation

An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted font may result in the disclosure of process memory...

Information disclosure

The issue was addressed with improved permissions logic. This issue is fixed in iOS 15 and iPadOS 15. An attacker with physical access to a device may be able to see private contact information...

Code injection

A logic issue was addressed with improved state management. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, watchOS 8, Security Update 2021-007 Catalina. Processing a malicious audio file may result in unexpected application termination or arbitrary code execution...

CVE-2021-30836

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory...

CVE-2021-30834

CVE-2021-30834 is a macOS Catalina/Apple Security Update 2021-007 issue affecting the CoreAudio component. The vulnerability is described as a logic issue in state handling when processing a malicious audio file, which could lead to unexpected application termination or arbitrary code execution. ...

CVE-2021-30836

CVE-2021-30836 is an out-of-bounds read vulnerability in WebKitGTK/WebKitGTK-based WebKit, manifested while processing a malicious audio file. The root cause is an input-validation/bounds-check issue leading to memory disclosure. Affected products include WebKitGTK/WebKitGTK2, with multiple advis...

CVE-2021-30836

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory...

CVE-2021-30834

A logic issue was addressed with improved state management. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, watchOS 8, Security Update 2021-007 Catalina. Processing a malicious audio file may result in unexpected application termination or arbitrary code execution...

CVE-2021-30840

This CVE (CVE-2021-30840) concerns Apple’s FontParser handling of dfont files. A maliciously crafted dfont could lead to arbitrary code execution due to a vulnerability in font processing. Apple indicates the issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Connected sources also align...

CVE-2021-30840

This issue was addressed with improved checks. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted dfont file may lead to arbitrary code execution...

CVE-2021-30831

CVE-2021-30831 concerns Apple’s FontParser, where processing a maliciously crafted font could cause an out-of-bounds read leading to disclosure of process memory. The connected Apple Watch content explicitly ties this CVE to FontParser and notes the underlying issue as an out-of-bounds read addre...

CVE-2021-30831

An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted font may result in the disclosure of process memory...

CVE-2021-30823

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS...

CVE-2021-30823

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS...

CVE-2021-30823

CVE-2021-30823 is a logic issue in WebKit that allowed bypassing HSTS when processing web content. It is addressed in macOS Monterey 12.0.1, iOS 14.8/iPadOS 14.8, tvOS 15, Safari 15, and watchOS 8. Connected sources also list WebKitGTK+ and Apple advisories referencing the same CVE as part of a b...

CVE-2021-30823

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS...

CVE-2021-30814

A memory corruption issue was addressed with improved input validation. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted image may lead to arbitrary code execution...

CVE-2021-30816

CVE-2021-30816 corresponds to a FaceTime-related information disclosure on Apple iOS 15 and iPadOS 15. The issue arises from permissions logic, allowing a locally present attacker with physical access to view private contact information. Apple patched this with improved permissions logic in iOS 1...

CVE-2021-30816

The issue was addressed with improved permissions logic. This issue is fixed in iOS 15 and iPadOS 15. An attacker with physical access to a device may be able to see private contact information...

CVE-2021-30818

CVE-2021-30818 is a type confusion vulnerability in WebKitGTK/WebKit, leading to arbitrary code execution when processing malicious web content. The issue is fixed in Apple platforms (iOS 14.8+, iPadOS 14.8+, Safari 15+, watchOS 8, tvOS 15) and is correlated with WebKitGTK/WebKit fixes in Linux p...