ID

VAR-202109-0284


CVE

CVE-2021-1739


TITLE

plural  Apple  Past traversal vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2021-013513

DESCRIPTION

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local user may be able to modify protected parts of the file system. plural Apple The product contains a path traversal vulnerability.Information may be tampered with. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Apple watchOS is a smart watch operating system developed by Apple (Apple). The following products and versions are affected: watchOS: 7.0 18R382, 7.0.1 18R395, 7.0.2 18R402, 7.0.3 18R410, 7.1 18R590, 7.2 18S564, 7.3 18S801, 7.3.1 18S811, 7.3.13, 18S832 . CVE-2021-30661: yangkang(@dnpushme) of 360 ATA Additional recognition AirDrop We would like to acknowledge @maxzks for their assistance. CoreAudio We would like to acknowledge an anonymous researcher for their assistance. CoreCrypto We would like to acknowledge Andy Russon of Orange Group for their assistance. File Bookmark We would like to acknowledge an anonymous researcher for their assistance. Foundation We would like to acknowledge CodeColorist of Ant-Financial LightYear Labs for their assistance. Kernel We would like to acknowledge Antonio Frighetto of Politecnico di Milano, GRIMM, Keyu Man, Zhiyun Qian, Zhongjie Wang, Xiaofeng Zheng, Youjun Huang, Haixin Duan, Mikko Kenttälä ( @Turmio_ ) of SensorFu, Proteas, and Tielei Wang of Pangu Lab for their assistance. Security We would like to acknowledge Xingwei Lin of Ant Security Light-Year Lab and john (@nyan_satan) for their assistance. sysdiagnose We would like to acknowledge Tim Michaud (@TimGMichaud) of Leviathan for their assistance. WebKit We would like to acknowledge Emilio Cobos Álvarez of Mozilla for their assistance. Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2021-04-26-2 macOS Big Sur 11.3 macOS Big Sur 11.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212325. APFS Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A logic issue was addressed with improved state management. CVE-2021-1853: Gary Nield of ECSC Group plc and Tim Michaud(@TimGMichaud) of Zoom Video Communications AppleMobileFileIntegrity Available for: macOS Big Sur Impact: A malicious application may be able to bypass Privacy preferences Description: An issue in code signature validation was addressed with improved checks. CVE-2021-1849: Siguza Apple Neural Engine Available for: macOS Big Sur Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1867: Zuozhi Fan (@pattern_F_) and Wish Wu(吴潍浠) of Ant Group Tianqiong Security Lab Archive Utility Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: A logic issue was addressed with improved state management. CVE-2021-1810: an anonymous researcher Audio Available for: macOS Big Sur Impact: An application may be able to read restricted memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1808: JunDong Xie of Ant Security Light-Year Lab CFNetwork Available for: macOS Big Sur Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A memory initialization issue was addressed with improved memory handling. CVE-2021-1857: an anonymous researcher CoreAudio Available for: macOS Big Sur Impact: Processing a maliciously crafted audio file may disclose restricted memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1846: JunDong Xie of Ant Security Light-Year Lab CoreAudio Available for: macOS Big Sur Impact: A malicious application may be able to read restricted memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1809: JunDong Xie of Ant Security Light-Year Lab CoreFoundation Available for: macOS Big Sur Impact: A malicious application may be able to leak sensitive user information Description: A validation issue was addressed with improved logic. CVE-2021-30659: Thijs Alkemade of Computest CoreGraphics Available for: macOS Big Sur Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2021-1847: Xuwei Liu of Purdue University CoreText Available for: macOS Big Sur Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: A logic issue was addressed with improved state management. CVE-2021-1811: Xingwei Lin of Ant Security Light-Year Lab curl Available for: macOS Big Sur Impact: An attacker may provide a fraudulent OCSP response that would appear valid Description: This issue was addressed with improved checks. CVE-2020-8286: an anonymous researcher curl Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: A buffer overflow was addressed with improved input validation. This was addressed with additional ownership checks. CVE-2021-1784: Mikko Kenttälä (@Turmio_) of SensorFu, Csaba Fitzl (@theevilbit) of Offensive Security, and an anonymous researcher FaceTime Available for: macOS Big Sur Impact: Muting a CallKit call while ringing may not result in mute being enabled Description: A logic issue was addressed with improved state management. CVE-2021-1872: Siraj Zaneer of Facebook FontParser Available for: macOS Big Sur Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1881: an anonymous researcher, Xingwei Lin of Ant Security Light-Year Lab, Mickey Jin of Trend Micro, and Hou JingYi (@hjy79425575) of Qihoo 360 Foundation Available for: macOS Big Sur Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved validation. CVE-2021-1882: Gabe Kirkpatrick (@gabe_k) Foundation Available for: macOS Big Sur Impact: A malicious application may be able to gain root privileges Description: A validation issue was addressed with improved logic. CVE-2021-1813: Cees Elzinga Heimdal Available for: macOS Big Sur Impact: Processing maliciously crafted server messages may lead to heap corruption Description: This issue was addressed with improved checks. CVE-2021-1883: Gabe Kirkpatrick (@gabe_k) Heimdal Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: A race condition was addressed with improved locking. CVE-2021-1884: Gabe Kirkpatrick (@gabe_k) ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: This issue was addressed with improved checks. CVE-2021-1880: Xingwei Lin of Ant Security Light-Year Lab CVE-2021-30653: Ye Zhang of Baidu Security CVE-2021-1814: Ye Zhang of Baidu Security, Mickey Jin & Qi Sun of Trend Micro, and Xingwei Lin of Ant Security Light-Year Lab CVE-2021-1843: Ye Zhang of Baidu Security ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-1885: CFF of Topsec Alpha Team ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2021-1858: Mickey Jin of Trend Micro Installer Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: This issue was addressed with improved handling of file metadata. CVE-2021-30658: Wojciech Reguła (@_r3ggi) of SecuRing Intel Graphics Driver Available for: macOS Big Sur Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2021-1841: Jack Dates of RET2 Systems, Inc. CVE-2021-1834: ABC Research s.r.o. working with Trend Micro Zero Day Initiative Kernel Available for: macOS Big Sur Impact: A malicious application may be able to disclose kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2021-1860: @0xalsr Kernel Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A memory corruption issue was addressed with improved validation. CVE-2021-1840: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab Kernel Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with kernel privileges Description: A logic issue was addressed with improved state management. CVE-2021-1851: @0xalsr Kernel Available for: macOS Big Sur Impact: Copied files may not have the expected file permissions Description: The issue was addressed with improved permissions logic. CVE-2021-1832: an anonymous researcher Kernel Available for: macOS Big Sur Impact: A malicious application may be able to disclose kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-30660: Alex Plaskett libxpc Available for: macOS Big Sur Impact: A malicious application may be able to gain root privileges Description: A race condition was addressed with additional validation. CVE-2021-30652: James Hutchins libxslt Available for: macOS Big Sur Impact: Processing a maliciously crafted file may lead to heap corruption Description: A double free issue was addressed with improved memory management. CVE-2021-1875: Found by OSS-Fuzz Login Window Available for: macOS Big Sur Impact: A malicious application with root privileges may be able to access private information Description: This issue was addressed with improved entitlements. CVE-2021-1824: Wojciech Reguła (@_r3ggi) of SecuRing Notes Available for: macOS Big Sur Impact: Locked Notes content may have been unexpectedly unlocked Description: A logic issue was addressed with improved state management. CVE-2021-1859: Syed Ali Shuja (@SyedAliShuja) of Colour King Pvt. Ltd NSRemoteView Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2021-1815: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) CVE-2021-1739: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) CVE-2021-1740: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: macOS Big Sur Impact: A malicious website may be able to track users by setting state in a cache Description: An issue existed in determining cache occupancy. CVE-2021-1861: Konstantinos Solomos of University of Illinois at Chicago Safari Available for: macOS Big Sur Impact: A malicious website may be able to force unnecessary network connections to fetch its favicon Description: A logic issue was addressed with improved state management. CVE-2021-1855: Håvard Mikkelsen Ottestad of HASMAC AS SampleAnalysis Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A logic issue was addressed with improved state management. CVE-2021-1868: Tim Michaud of Zoom Communications smbx Available for: macOS Big Sur Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: An integer overflow was addressed with improved input validation. CVE-2021-1878: Aleksandar Nikolic of Cisco Talos (talosintelligence.com) System Preferences Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: A logic issue was addressed with improved state management. CVE-2021-30657: an anonymous researcher tcpdump Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: This issue was addressed with improved checks. CVE-2020-8037: an anonymous researcher Time Machine Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: The issue was addressed with improved permissions logic. CVE-2021-1839: Tim Michaud(@TimGMichaud) of Zoom Video Communications and Gary Nield of ECSC Group plc WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: An input validation issue was addressed with improved input validation. CVE-2021-1825: Alex Camboe of Aon’s Cyber Solutions WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved state management. CVE-2021-1817: an anonymous researcher WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue was addressed with improved restrictions. CVE-2021-1826: an anonymous researcher WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2021-1820: an anonymous researcher WebKit Storage Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. CVE-2021-30661: yangkang(@dnpushme) of 360 ATA WebRTC Available for: macOS Big Sur Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2020-7463: Megan2013678 Wi-Fi Available for: macOS Big Sur Impact: An application may be able to cause unexpected system termination or write kernel memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1828: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab Wi-Fi Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with kernel privileges Description: A type confusion issue was addressed with improved state handling. CVE-2021-1829: Tielei Wang of Pangu Lab Wi-Fi Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2021-30655: Gary Nield of ECSC Group plc and Tim Michaud(@TimGMichaud) of Zoom Video Communications and Wojciech Reguła (@_r3ggi) of SecuRing Windows Server Available for: macOS Big Sur Impact: A malicious application may be able to unexpectedly leak a user's credentials from secure text fields Description: An API issue in Accessibility TCC permissions was addressed with improved state management. CVE-2021-1873: an anonymous researcher Installation note: This update may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAmCHO0UACgkQZcsbuWJ6 jjA/XA/7BDDpbLo0btLbUrps6ELmcqFZhpvhuekw8Yd3jVeJihLcJGJpY38ZCcne srCJHuXPzlk3ex0bVkKNRrB04xF0vCA4TEBsJ495754PAKWrxmlx0Ce8zg4h+ey/ cMTaUgfB1sgOFO8kJCKJurCjhyQ3Xj5c5xa8/zxlKoAgI36PmhZsCoXC6KD+5mqn QCRF0kE/y0QSfsq13j4grLGMXLS4pkAJRMWvDiEliYDTw3pOul7ZDOwxLEyucVTv fE60H7ff7jfPbDcQ4yEgEbla40+YZYwl9Sv4zxIU2OBPva6HLbA+PXxk4F1QX7eA ECrfycMSIbQKZ2phryENZCcrX5DN4M/VcGIHq4ujF2CXBJymSWV0O5k5K0GzZ0Ko T2Zr2LOOunvHGrYy0okholNYb0iMA09dvwuDdEGr+vhLZhq1BBbmThhNEnArl7mE /fx2bvaS3o8TxGuh7mbeFK9q5Tafxe5Qhwgz9pnAtqBC8z1NgQoetk9pKPNDIsNY t3/7Xcix+fs28YOjmxPTpntud0EGSjxXm4g0bDbsU922iV1Z3ncgOvd//IzPXniS v4IqR/gPbhg+c2CGoaezD91sE5onLuMmFCogkUyftGHnN0EueKMjI+3fmyG4l4d1 0C3to6hKJNmTm56RgxwfVVOeVnsPF490s9LUYzO4ZUbaQHIuDfo= =9+Ju -----END PGP SIGNATURE----- . Accessibility Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A person with physical access to an iOS device may be able to access notes from the lock screen Description: This issue was addressed with improved checks. CVE-2021-1835: videosdebarraquito App Store Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An attacker in a privileged network position may be able to alter network traffic Description: A certificate validation issue was addressed. CVE-2021-1849: Siguza Assets Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A local user may be able to create or modify privileged files Description: A logic issue was addressed with improved restrictions. CVE-2021-1822: Bruno Virlet of The Grizzly Labs Password Manager Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A user's password may be visible on screen Description: An issue obscuring passwords in screenshots was addressed with improved logic. CVE-2021-1807: David Schütz (@xdavidhu) Shortcuts Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may allow shortcuts to access restricted files Description: The issue was addressed with improved permissions logic. CVE-2021-1868: Tim Michaud of Zoom Communications Telephony Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops. CVE-2021-1854: Steven Thorne of Cspire Wallet Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A local user may be able to view sensitive information in the app switcher Description: The issue was addressed with improved UI handling. CVE-2020-7463: Megan2013678 Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device

Trust: 2.79

sources: NVD: CVE-2021-1739 // JVNDB: JVNDB-2021-013513 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-376399 // PACKETSTORM: 162360 // PACKETSTORM: 162362 // PACKETSTORM: 162370 // PACKETSTORM: 162369 // PACKETSTORM: 162358 // PACKETSTORM: 162357

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:eqversion:10.15.6

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:14.5

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:7.4

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:14.5

Trust: 1.0

vendor:applemodel:mac os xscope:lteversion:10.14.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.14.6

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.3

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.14

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.15

Trust: 1.0

vendor:applemodel:mac os xscope:lteversion:10.15.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.15.7

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.15

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:14.5

Trust: 1.0

vendor:アップルmodel:apple mac os xscope: - version: -

Trust: 0.8

vendor:アップルmodel:ipadosscope: - version: -

Trust: 0.8

vendor:アップルmodel:watchosscope: - version: -

Trust: 0.8

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

vendor:アップルmodel:macosscope: - version: -

Trust: 0.8

vendor:アップルmodel:tvosscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-013513 // NVD: CVE-2021-1739

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1739
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-1739
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-1988
value: MEDIUM

Trust: 0.6

VULHUB: VHN-376399
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2021-1739
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-376399
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1739
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-1739
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-376399 // JVNDB: JVNDB-2021-013513 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-1988 // NVD: CVE-2021-1739

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.1

problemtype:Path traversal (CWE-22) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-376399 // JVNDB: JVNDB-2021-013513 // NVD: CVE-2021-1739

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202104-1988

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-376399

PATCH

title:HT212326 Apple  Security updateurl:https://support.apple.com/en-us/HT212317

Trust: 0.8

title:Apple watchOS Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=148665

Trust: 0.6

title:Apple: macOS Big Sur 11.3url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=c631c09ebe15d0799205eda727cdfeb3

Trust: 0.1

sources: VULMON: CVE-2021-1739 // JVNDB: JVNDB-2021-013513 // CNNVD: CNNVD-202104-1988

EXTERNAL IDS

db:NVDid:CVE-2021-1739

Trust: 4.0

db:PACKETSTORMid:162357

Trust: 0.8

db:JVNDBid:JVNDB-2021-013513

Trust: 0.8

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:AUSCERTid:ESB-2021.1408.2

Trust: 0.6

db:CS-HELPid:SB2021042808

Trust: 0.6

db:CNNVDid:CNNVD-202104-1988

Trust: 0.6

db:PACKETSTORMid:162370

Trust: 0.2

db:PACKETSTORMid:162358

Trust: 0.2

db:PACKETSTORMid:162362

Trust: 0.2

db:PACKETSTORMid:162360

Trust: 0.2

db:PACKETSTORMid:162369

Trust: 0.2

db:VULHUBid:VHN-376399

Trust: 0.1

db:VULMONid:CVE-2021-1739

Trust: 0.1

sources: VULHUB: VHN-376399 // VULMON: CVE-2021-1739 // JVNDB: JVNDB-2021-013513 // PACKETSTORM: 162360 // PACKETSTORM: 162362 // PACKETSTORM: 162370 // PACKETSTORM: 162369 // PACKETSTORM: 162358 // PACKETSTORM: 162357 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-1988 // NVD: CVE-2021-1739

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2021-1739

Trust: 2.0

url:https://support.apple.com/en-us/ht212317

Trust: 1.7

url:https://support.apple.com/en-us/ht212323

Trust: 1.7

url:https://support.apple.com/en-us/ht212324

Trust: 1.7

url:https://support.apple.com/en-us/ht212325

Trust: 1.7

url:https://support.apple.com/en-us/ht212326

Trust: 1.7

url:https://support.apple.com/en-us/ht212327

Trust: 1.7

url:https://support.apple.com/kb/ht201222

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1813

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1809

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1843

Trust: 0.6

url:https://www.apple.com/support/security/pgp/

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1811

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1808

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1408.2

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021042808

Trust: 0.6

url:https://packetstormsecurity.com/files/162357/apple-security-advisory-2021-04-26-1.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-35171

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1851

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2021-1740

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2021-1860

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1857

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1875

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1868

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1820

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1815

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1817

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1846

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1825

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1826

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1832

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1840

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1828

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-8037

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1784

Trust: 0.3

url:https://support.apple.com/downloads/

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1839

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-8285

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1834

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-8286

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1849

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1816

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1822

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1876

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1847

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-27942

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1810

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1824

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-3838

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1797

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1873

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1864

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1814

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1858

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1807

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1836

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-7463

Trust: 0.2

url:https://support.apple.com/kb/ht212325

Trust: 0.1

url:https://support.apple.com/ht212326.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1878

Trust: 0.1

url:https://support.apple.com/ht212327.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1806

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1805

Trust: 0.1

url:https://support.apple.com/kb/ht204641

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1872

Trust: 0.1

url:https://support.apple.com/ht212324.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1880

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1844

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1881

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1882

Trust: 0.1

url:https://support.apple.com/ht212323.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1841

Trust: 0.1

url:https://support.apple.com/ht212325.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1829

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1848

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1837

Trust: 0.1

url:https://www.apple.com/itunes/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1854

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1835

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1830

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1852

Trust: 0.1

url:https://support.apple.com/ht212317.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1831

Trust: 0.1

sources: VULHUB: VHN-376399 // VULMON: CVE-2021-1739 // JVNDB: JVNDB-2021-013513 // PACKETSTORM: 162360 // PACKETSTORM: 162362 // PACKETSTORM: 162370 // PACKETSTORM: 162369 // PACKETSTORM: 162358 // PACKETSTORM: 162357 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-1988 // NVD: CVE-2021-1739

CREDITS

Apple

Trust: 1.2

sources: PACKETSTORM: 162360 // PACKETSTORM: 162362 // PACKETSTORM: 162370 // PACKETSTORM: 162369 // PACKETSTORM: 162358 // PACKETSTORM: 162357 // CNNVD: CNNVD-202104-1988

SOURCES

db:VULHUBid:VHN-376399
db:VULMONid:CVE-2021-1739
db:JVNDBid:JVNDB-2021-013513
db:PACKETSTORMid:162360
db:PACKETSTORMid:162362
db:PACKETSTORMid:162370
db:PACKETSTORMid:162369
db:PACKETSTORMid:162358
db:PACKETSTORMid:162357
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202104-1988
db:NVDid:CVE-2021-1739

LAST UPDATE DATE

2024-08-14T12:46:26.805000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-376399date:2021-09-15T00:00:00
db:JVNDBid:JVNDB-2021-013513date:2022-09-14T09:02:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202104-1988date:2021-09-16T00:00:00
db:NVDid:CVE-2021-1739date:2021-09-15T14:02:12.030

SOURCES RELEASE DATE

db:VULHUBid:VHN-376399date:2021-09-08T00:00:00
db:JVNDBid:JVNDB-2021-013513date:2022-09-14T00:00:00
db:PACKETSTORMid:162360date:2021-04-28T14:58:36
db:PACKETSTORMid:162362date:2021-04-28T15:00:23
db:PACKETSTORMid:162370date:2021-04-28T15:11:14
db:PACKETSTORMid:162369date:2021-04-28T15:10:17
db:PACKETSTORMid:162358date:2021-04-28T14:55:56
db:PACKETSTORMid:162357date:2021-04-28T14:54:48
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202104-1988date:2021-04-27T00:00:00
db:NVDid:CVE-2021-1739date:2021-09-08T15:15:09.120