CVE-2021-1844 — Out-of-bounds Write in Apple Macos

CWE-787 — Out-of-bounds Write CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer11 documents10 sources

Severity

8.8HIGHNVD

EPSS

1.4%

top 19.55%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apple Macos Apple Ipados Apple Iphone OS +5 more

Timeline

PublishedApr 2

Latest updateMay 24

Description

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5apple/macosunspecified — 11.2+3

▶NVDapple/macos< 11.2.3

▶NVDapple/ipados< 14.4.1

▶NVDapple/safari< 14.0.3

▶NVDapple/watchos< 7.3.2

Also affects: Debian Linux 10.0, Fedora 33

🔴Vulnerability Details

GHSA

GHSA-7j8f-prmh-229c: A memory corruption issue was addressed with improved validation↗2022-05-24

▶

Project0

The More You Know, The More You Know You Don’t Know - Project Zero↗2022-04-01

▶

OSV

CVE-2021-1844: A memory corruption issue was addressed with improved validation↗2021-04-02

▶

CVEList

CVE-2021-1844: A memory corruption issue was addressed with improved validation↗2021-04-02

▶

📋Vendor Advisories

Ubuntu

WebKitGTK vulnerabilities↗2021-05-10

▶

Red Hat

webkitgtk: Memory corruption issue leading to arbitrary code execution↗2021-03-29

▶

Debian

CVE-2021-1844: webkit2gtk - A memory corruption issue was addressed with improved validation. This issue is ...↗2021

▶

🕵️Threat Intelligence

Recorded Future

Tracking Candiru’s DevilsTongue Spyware in Multiple Countries↗

▶

Recorded Future

Tracking Candiru’s DevilsTongue Spyware in Multiple Countries↗

▶

💬Community

Bugzilla

CVE-2020-12108 mailman: arbitrary content injection via the options login page↗2020-06-19

▶