CVE-2021-1867
published 2021-09-08CVE-2021-1867: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.5 and iPadOS 14.5, macOS Big Sur 11.3. A malicious…
PriorityP350high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.85%
76.8th percentile
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.5 and iPadOS 14.5, macOS Big Sur 11.3. A malicious application may be able to execute arbitrary code with kernel privileges.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_14.5_and_ipados | — | — |
| apple | ios_and_ipados | >= unspecified < 14.5 | 14.5 |
| apple | ipados | < 14.5 | 14.5 |
| apple | iphone_os | < 14.5 | 14.5 |
| apple | macos | >= 11.0 < 11.3 | 11.3 |
| apple | macos | >= unspecified < 11.3 | 11.3 |
| apple | macos_big_sur | — | — |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vw8w-f3p8-wppg: An out-of-bounds read was addressed with improved input validation
ghsa_unreviewed·2022-05-24
CVE-2021-1867 [HIGH] CWE-125 GHSA-vw8w-f3p8-wppg: An out-of-bounds read was addressed with improved input validation
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.5 and iPadOS 14.5, macOS Big Sur 11.3. A malicious application may be able to execute arbitrary code with kernel privileges.
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2022-1859
vendor_chrome·2022-05-31·CVSS 9.8
CVE-2022-1859 [HIGH] Long Term Support Channel Update for ChromeOS: CVE-2022-1859
Long Term Support Channel Update for ChromeOS
CVE-2022-1859: Use after free in Performance Manager. 1297283 High CVE-2022-1636: Use after free in Performance APIs 1278608 High CVE-2021-43527 [internally reported] 1304660 High CVE-2022-23308 CrOS: Vulnerability reported in dev-libs/libxml2 1315563 Medium CVE-2022-1867: Insufficient validation of untrusted input in Data Transfer
Severity: high
Apple
CVE-2021-1867: macOS Big Sur 11.3
vendor_apple·2021-04-26·CVSS 8.8
CVE-2021-1867 [HIGH] CVE-2021-1867: macOS Big Sur 11.3
Apple Security Update: About the security content of macOS Big Sur 11.3
Product: macOS Big Sur
Version: 11.3
CVE: CVE-2021-1867
Impact: A malicious application may be able to execute arbitrary code with kernel privileges
Description: An out-of-bounds read was addressed with improved input validation.
Apple
CVE-2021-1867: iOS 14.5 and iPadOS 14.5
vendor_apple·2021-04-26·CVSS 8.8
CVE-2021-1867 [HIGH] CVE-2021-1867: iOS 14.5 and iPadOS 14.5
Apple Security Update: About the security content of iOS 14.5 and iPadOS 14.5
Product: iOS 14.5 and iPadOS
Version: 14.5
CVE: CVE-2021-1867
Impact: A malicious application may be able to execute arbitrary code with kernel privileges
Description: An out-of-bounds read was addressed with improved input validation.
No detection rules found.
No public exploits indexed.
Qualys
iOS / iPadOS 14.5 Updates: Identify Assets Requiring Update and Take Remote Action with VMDR for Mobile Devices | Qualys
blogs_qualys·2021-04-28·CVSS 5.5
[MEDIUM] iOS / iPadOS 14.5 Updates: Identify Assets Requiring Update and Take Remote Action with VMDR for Mobile Devices | Qualys
Apple recently released iOS 14.5 and iPadOS 14.5 which include a security update that addresses almost 50 vulnerabilities including several critical RCE and privilege escalation vulnerabilities. Qualys recommends security teams to immediately update all devices running iOS and iPadOS to the latest version.
The vulnerabilities affect iOS and iPadOS components including Accessibility, CFNetwork, CoreFoundation, FaceTime, Safari, ImageIO, Kernel, Preferences, Safari, WebKit, and others. As part of the releases, Apple has also made major enhancements related to zero-click (or 0-click) exploit protection that make it more difficult for hackers to take control of an iPhone. Zero-click exploits allow a hacker to take over an iPhone with no interaction from the target, as evidenced by this zero-c
Qualys
iOS / iPadOS 14.5 Updates: Identify Assets Requiring Update and Take Remote Action with VMDR for Mobile Devices
blogs_qualys·2021-04-28·CVSS 5.5
[MEDIUM] iOS / iPadOS 14.5 Updates: Identify Assets Requiring Update and Take Remote Action with VMDR for Mobile Devices
Apple recently released iOS 14.5 and iPadOS 14.5 which include a security update that addresses almost 50 vulnerabilities including several critical RCE and privilege escalation vulnerabilities. Qualys recommends security teams to immediately update all devices running iOS and iPadOS to the latest version.
The vulnerabilities affect iOS and iPadOS components including Accessibility, CFNetwork, CoreFoundation, FaceTime, Safari, ImageIO, Kernel, Preferences, Safari, WebKit, and others. As part of the releases, Apple has also made major enhancements related to zero-click (or 0-click) exploit protection that make it more difficult for hackers to take control of an iPhone. Zero-click exploits allow a hacker to take over an iPhone with no interaction from the target, as evidenced by this zero-c
2021-09-08
Published