Sign-up

ID

VAR-202104-0616


CVE

CVE-2021-1793


TITLE

Apple macOS Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202102-080

DESCRIPTION

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution. Apple macOS is a set of dedicated operating systems developed by Apple Corporation for Mac computers. There is a security vulnerability in Apple macOS. The vulnerability originates from the boundary condition when handling font files in the FontParser component in macOS. A remote attacker could create a specially crafted file or web page that tricks a victim into opening the file, triggering an out-of-bounds read error and reading the contents of memory on the system. Vulnerabilities exist in the following products or versions: macOS 10.15, macOS 10.15 SU1, macOS 10.15.1, macOS 10.15.2, macOS 10.15.3, macOS 10.15.4, macOS 10.15.4 SU1, macOS 10.15.5, macOS 11.55.5 SU1 , macOS 15.65.6, macOS 10.15.6 SU1, macOS 10.15.7, 10.15.7 SU1, macOS 11.0, macOS 11.0.1, macOS 11.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2021-02-01-4 Additional information for APPLE-SA-2021-01-26-3 watchOS 7.3 watchOS 7.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212148. Analytics Available for: Apple Watch Series 3 and later Impact: A remote attacker may be able to cause a denial of service Description: This issue was addressed with improved checks. CVE-2021-1761: Cees Elzinga Entry added February 1, 2021 APFS Available for: Apple Watch Series 3 and later Impact: A local user may be able to read arbitrary files Description: The issue was addressed with improved permissions logic. CVE-2021-1797: Thomas Tempelmann Entry added February 1, 2021 CoreAnimation Available for: Apple Watch Series 3 and later Impact: A malicious application could execute arbitrary code leading to compromise of user information Description: A memory corruption issue was addressed with improved state management. CVE-2021-1760: @S0rryMybad of 360 Vulcan Team Entry added February 1, 2021 CoreAudio Available for: Apple Watch Series 3 and later Impact: Processing maliciously crafted web content may lead to code execution Description: An out-of-bounds write was addressed with improved input validation. CVE-2021-1747: JunDong Xie of Ant Security Light-Year Lab Entry added February 1, 2021 CoreGraphics Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2021-1776: Ivan Fratric of Google Project Zero Entry added February 1, 2021 CoreText Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted text file may lead to arbitrary code execution Description: A stack overflow was addressed with improved input validation. CVE-2021-1772: Mickey Jin of Trend Micro Entry added February 1, 2021 CoreText Available for: Apple Watch Series 3 and later Impact: A remote attacker may be able to cause arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-1792: Mickey Jin & Junzhi Lu of Trend Micro Entry added February 1, 2021 Crash Reporter Available for: Apple Watch Series 3 and later Impact: A local user may be able to create or modify system files Description: A logic issue was addressed with improved state management. CVE-2021-1786: Csaba Fitzl (@theevilbit) of Offensive Security Entry added February 1, 2021 Crash Reporter Available for: Apple Watch Series 3 and later Impact: A local attacker may be able to elevate their privileges Description: Multiple issues were addressed with improved logic. CVE-2021-1787: James Hutchins Entry added February 1, 2021 FairPlay Available for: Apple Watch Series 3 and later Impact: A malicious application may be able to disclose kernel memory Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. CVE-2021-1791: Junzhi Lu (@pwn0rz), Qi Sun & Mickey Jin of Trend Micro Entry added February 1, 2021 FontParser Available for: Apple Watch Series 3 and later Impact: A remote attacker may be able to cause arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-1758: Peter Nguyen of STAR Labs Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted image may lead to a denial of service Description: A logic issue was addressed with improved state management. CVE-2021-1773: Xingwei Lin of Ant Security Light-Year Lab Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted image may lead to a denial of service Description: This issue was addressed with improved checks. CVE-2021-1766: Danny Rosseau of Carve Systems Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1785: Xingwei Lin of Ant Security Light-Year Lab Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write was addressed with improved input validation. CVE-2021-1744: Xingwei Lin of Ant Security Light-Year Lab Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A logic issue was addressed with improved state management. CVE-2021-1818: Xingwei Lin from Ant-Financial Light-Year Security Lab Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: This issue was addressed with improved checks. CVE-2021-1746: Xingwei Lin of Ant Security Light-Year Lab, and Mickey Jin & Qi Sun of Trend Micro CVE-2021-1793: Xingwei Lin of Ant Security Light-Year Lab Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-1741: Xingwei Lin of Ant Security Light-Year Lab CVE-2021-1743: Xingwei Lin of Ant Security Light-Year Lab, and Mickey Jin & Junzhi Lu of Trend Micro Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted image may lead to a denial of service Description: An out-of-bounds read issue existed in the curl. CVE-2021-1778: Xingwei Lin of Ant Security Light-Year Lab Entry added February 1, 2021 ImageIO Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An access issue was addressed with improved memory management. CVE-2021-1783: Xingwei Lin of Ant Security Light-Year Lab Entry added February 1, 2021 IOSkywalkFamily Available for: Apple Watch Series 3 and later Impact: A local attacker may be able to elevate their privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-1757: Proteas and Pan ZhenPeng (@Peterpan0927) of Alibaba Security Entry added February 1, 2021 iTunes Store Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted URL may lead to arbitrary javascript code execution Description: A validation issue was addressed with improved input sanitization. CVE-2021-1748: CodeColorist of Ant-Financial Light-Year Labs Entry added February 1, 2021 Kernel Available for: Apple Watch Series 3 and later Impact: A remote attacker may be able to cause a denial of service Description: A use after free issue was addressed with improved memory management. CVE-2021-1764: Maxime Villard (m00nbsd) Entry added February 1, 2021 Kernel Available for: Apple Watch Series 3 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple issues were addressed with improved logic. CVE-2021-1750: @0xalsr Entry added February 1, 2021 Kernel Available for: Apple Watch Series 3 and later Impact: A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited. CVE-2021-1782: an anonymous researcher Swift Available for: Apple Watch Series 3 and later Impact: A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication Description: A logic issue was addressed with improved validation. CVE-2021-1769: CodeColorist of Ant-Financial Light-Year Labs Entry added February 1, 2021 WebKit Available for: Apple Watch Series 3 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2021-1788: Francisco Alonso (@revskills) Entry added February 1, 2021 WebKit Available for: Apple Watch Series 3 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved state handling. CVE-2021-1789: @S0rryMybad of 360 Vulcan Team Entry added February 1, 2021 WebKit Available for: Apple Watch Series 3 and later Impact: Maliciously crafted web content may violate iframe sandboxing policy Description: This issue was addressed with improved iframe sandbox enforcement. CVE-2021-1801: Eliya Stein of Confiant Entry added February 1, 2021 WebRTC Available for: Apple Watch Series 3 and later Impact: A malicious website may be able to access restricted ports on arbitrary servers Description: A port redirection issue was addressed with additional port validation. CVE-2021-1799: Gregory Vishnepolsky & Ben Seri of Armis Security, and Samy Kamkar Entry added February 1, 2021 Additional recognition iTunes Store We would like to acknowledge CodeColorist of Ant-Financial Light-Year Labs for their assistance. Entry added February 1, 2021 Kernel We would like to acknowledge Junzhi Lu (@pwn0rz), Mickey Jin & Jesse Change of Trend Micro for their assistance. Entry added February 1, 2021 libpthread We would like to acknowledge CodeColorist of Ant-Financial Light-Year Labs for their assistance. Entry added February 1, 2021 Store Demo We would like to acknowledge @08Tc3wBB for their assistance. Entry added February 1, 2021 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAmAYgucACgkQZcsbuWJ6 jjDy4Q//e4Vg3wXzKy5FU+Bh4pAILb7SXtD3pp20CbjKP7DcFNCXFCPU/7pEYeu/ U+0OGyIJQUQ6hrd2fPKFPGZn7NWZFmzu12z1VjYbNPgbkYHaI2Lz8zQ1gK2RMSVf 1a7rN/P87AJ1lYjhKwTCL61lcozPg7u/bqdkWyxDYKq0vnV4/m11FB8oGZTlllgG qWdptjr0VZH0A2/BjTAe89vRlZyO7D5DW8fL1UEPEKCtLdH+XeDcyQSOzqCS4Olv hdjG8nuegbOli9zemOQiTdL/YxS9l4lOMHkueynr2QtrP/9SHyDdj+8ByKKwghVH 6+0i+0OtjK9ZIc5+FIQMe9BiC/zdkwrlxhXrqN7bUgHTsGRIlVKCCx7n0HFRiazh OBlRd8lrQcjkQElzTPtxtFgeU1RA8t85n1mCy9IJAFveDot0M2rFpYq17kuRRbiZ gv3zO2+hmbE+hd07qqOMRA58KNIMt29NPxONW0SeDcuV8jZBYD61gBumei5TGdPC /ArhziaIYLrySUg3DYNXpPETm8CrgAjNZ3/G/xJD0e5g/eXT0Y/y8Njwd6KC4OZ4 yWFq4yZ0Alur30apREvPrAfcvmmE7Gb3MbXpzOJFAmVeayNR5bqQyRrM58pMhFsK Q+fRFLprgdLzMFd7jvUtsipiZ9VHFOYVKdx/saVVdZOGglGC4Ww=GdjQ -----END PGP SIGNATURE-----

Trust: 1.17

sources: NVD: CVE-2021-1793 // VULHUB: VHN-376453 // VULMON: CVE-2021-1793 // PACKETSTORM: 161248

AFFECTED PRODUCTS

vendor:applemodel:watchosscope:ltversion:7.3

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:14.4

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.15

Trust: 1.0

vendor:applemodel:ipad osscope:ltversion:14.4

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0.1

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.15.7

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.15.7

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:14.4

Trust: 1.0

sources: NVD: CVE-2021-1793

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1793
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202102-080
value: HIGH

Trust: 0.6

VULHUB: VHN-376453
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-1793
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-1793
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-376453
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1793
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-376453 // VULMON: CVE-2021-1793 // CNNVD: CNNVD-202102-080 // NVD: CVE-2021-1793

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2021-1793

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202102-080

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202102-080

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-376453

PATCH
title:Apple macOS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=140292
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202102-080

EXTERNAL IDS
db:NVDid:CVE-2021-1793
Trust: 1.9
db:PACKETSTORMid:161248
Trust: 0.8
db:AUSCERTid:ESB-2021.0354
Trust: 0.6
db:CNNVDid:CNNVD-202102-080
Trust: 0.6
db:VULHUBid:VHN-376453
Trust: 0.1
db:VULMONid:CVE-2021-1793
Trust: 0.1
sources:
            
            
            VULHUB: VHN-376453 // 
            
            
            
            VULMON: CVE-2021-1793 // 
            
            
            
            PACKETSTORM: 161248 // 
            
            
            
            CNNVD: CNNVD-202102-080 // 
            
            
            
            NVD: CVE-2021-1793

REFERENCES
url:https://support.apple.com/en-us/ht212146
Trust: 1.8
url:https://support.apple.com/en-us/ht212147
Trust: 1.8
url:https://support.apple.com/en-us/ht212148
Trust: 1.8
url:https://support.apple.com/en-us/ht212149
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2021-1793
Trust: 0.7
url:https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-34452
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.0354/
Trust: 0.6
url:https://packetstormsecurity.com/files/161248/apple-security-advisory-2021-02-01-4.html
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:http://seclists.org/fulldisclosure/2021/feb/17
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1789
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1760
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1766
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1783
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1787
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1757
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1785
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1769
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1761
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1744
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1748
Trust: 0.1
url:https://support.apple.com/ht212148.
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1764
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1773
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1776
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1791
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1778
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1786
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1772
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1743
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1758
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1792
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1782
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1788
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1750
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1746
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1747
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-1741
Trust: 0.1
sources:
            
            
            VULHUB: VHN-376453 // 
            
            
            
            VULMON: CVE-2021-1793 // 
            
            
            
            PACKETSTORM: 161248 // 
            
            
            
            CNNVD: CNNVD-202102-080 // 
            
            
            
            NVD: CVE-2021-1793

CREDITS
Apple
Trust: 0.7
sources:
            
            
            PACKETSTORM: 161248 // 
            
            
            
            CNNVD: CNNVD-202102-080

SOURCES
db:VULHUBid:VHN-376453
db:VULMONid:CVE-2021-1793
db:PACKETSTORMid:161248
db:CNNVDid:CNNVD-202102-080
db:NVDid:CVE-2021-1793

LAST UPDATE DATE
2024-08-14T13:09:20.944000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-376453date:2021-04-13T00:00:00
db:VULMONid:CVE-2021-1793date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202102-080date:2021-04-14T00:00:00
db:NVDid:CVE-2021-1793date:2021-04-13T19:24:01.913

SOURCES RELEASE DATE
db:VULHUBid:VHN-376453date:2021-04-02T00:00:00
db:VULMONid:CVE-2021-1793date:2021-04-02T00:00:00
db:PACKETSTORMid:161248date:2021-02-02T16:09:50
db:CNNVDid:CNNVD-202102-080date:2021-02-02T00:00:00
db:NVDid:CVE-2021-1793date:2021-04-02T19:15:19.083