ID

VAR-202109-0341


CVE

CVE-2021-1826


TITLE

Pillow Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

DESCRIPTION

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to universal cross site scripting. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. A cross-site scripting vulnerability exists in WebKitGTK+, which stems from insufficient sanitization of user-supplied data in WebKit. The following products and versions are affected: WebKitGTK+: 2.30.0, 2.30.1, 2.30.2, 2.30.3, 2.30.4, 2.30.5, 2.30.6, 2.31.1, 2.31.90, 2.31.91, 2.32 .0. CVE-2021-30661: yangkang(@dnpushme) of 360 ATA Additional recognition AirDrop We would like to acknowledge @maxzks for their assistance. CoreAudio We would like to acknowledge an anonymous researcher for their assistance. CoreCrypto We would like to acknowledge Andy Russon of Orange Group for their assistance. File Bookmark We would like to acknowledge an anonymous researcher for their assistance. Foundation We would like to acknowledge CodeColorist of Ant-Financial LightYear Labs for their assistance. Kernel We would like to acknowledge Antonio Frighetto of Politecnico di Milano, GRIMM, Keyu Man, Zhiyun Qian, Zhongjie Wang, Xiaofeng Zheng, Youjun Huang, Haixin Duan, Mikko Kenttälä ( @Turmio_ ) of SensorFu, Proteas, and Tielei Wang of Pangu Lab for their assistance. Security We would like to acknowledge Xingwei Lin of Ant Security Light-Year Lab and john (@nyan_satan) for their assistance. sysdiagnose We would like to acknowledge Tim Michaud (@TimGMichaud) of Leviathan for their assistance. WebKit We would like to acknowledge Emilio Cobos Álvarez of Mozilla for their assistance. Alternatively, on your watch, select "My Watch > General > About". Information about the security content is also available at https://support.apple.com/HT212325. APFS Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A logic issue was addressed with improved state management. CVE-2021-1853: Gary Nield of ECSC Group plc and Tim Michaud(@TimGMichaud) of Zoom Video Communications AppleMobileFileIntegrity Available for: macOS Big Sur Impact: A malicious application may be able to bypass Privacy preferences Description: An issue in code signature validation was addressed with improved checks. CVE-2021-1849: Siguza Apple Neural Engine Available for: macOS Big Sur Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1867: Zuozhi Fan (@pattern_F_) and Wish Wu(吴潍浠) of Ant Group Tianqiong Security Lab Archive Utility Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: A logic issue was addressed with improved state management. CVE-2021-1810: an anonymous researcher Audio Available for: macOS Big Sur Impact: An application may be able to read restricted memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1808: JunDong Xie of Ant Security Light-Year Lab CFNetwork Available for: macOS Big Sur Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A memory initialization issue was addressed with improved memory handling. CVE-2021-1857: an anonymous researcher CoreAudio Available for: macOS Big Sur Impact: Processing a maliciously crafted audio file may disclose restricted memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1846: JunDong Xie of Ant Security Light-Year Lab CoreAudio Available for: macOS Big Sur Impact: A malicious application may be able to read restricted memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1809: JunDong Xie of Ant Security Light-Year Lab CoreFoundation Available for: macOS Big Sur Impact: A malicious application may be able to leak sensitive user information Description: A validation issue was addressed with improved logic. CVE-2021-30659: Thijs Alkemade of Computest CoreGraphics Available for: macOS Big Sur Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2021-1847: Xuwei Liu of Purdue University CoreText Available for: macOS Big Sur Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: A logic issue was addressed with improved state management. CVE-2021-1811: Xingwei Lin of Ant Security Light-Year Lab curl Available for: macOS Big Sur Impact: An attacker may provide a fraudulent OCSP response that would appear valid Description: This issue was addressed with improved checks. CVE-2020-8286: an anonymous researcher curl Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: A buffer overflow was addressed with improved input validation. CVE-2020-8285: xnynx DiskArbitration Available for: macOS Big Sur Impact: A malicious application may be able to modify protected parts of the file system Description: A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks. CVE-2021-1784: Mikko Kenttälä (@Turmio_) of SensorFu, Csaba Fitzl (@theevilbit) of Offensive Security, and an anonymous researcher FaceTime Available for: macOS Big Sur Impact: Muting a CallKit call while ringing may not result in mute being enabled Description: A logic issue was addressed with improved state management. CVE-2021-1872: Siraj Zaneer of Facebook FontParser Available for: macOS Big Sur Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1881: an anonymous researcher, Xingwei Lin of Ant Security Light-Year Lab, Mickey Jin of Trend Micro, and Hou JingYi (@hjy79425575) of Qihoo 360 Foundation Available for: macOS Big Sur Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved validation. CVE-2021-1882: Gabe Kirkpatrick (@gabe_k) Foundation Available for: macOS Big Sur Impact: A malicious application may be able to gain root privileges Description: A validation issue was addressed with improved logic. CVE-2021-1813: Cees Elzinga Heimdal Available for: macOS Big Sur Impact: Processing maliciously crafted server messages may lead to heap corruption Description: This issue was addressed with improved checks. CVE-2021-1883: Gabe Kirkpatrick (@gabe_k) Heimdal Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: A race condition was addressed with improved locking. CVE-2021-1884: Gabe Kirkpatrick (@gabe_k) ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: This issue was addressed with improved checks. CVE-2021-1880: Xingwei Lin of Ant Security Light-Year Lab CVE-2021-30653: Ye Zhang of Baidu Security CVE-2021-1814: Ye Zhang of Baidu Security, Mickey Jin & Qi Sun of Trend Micro, and Xingwei Lin of Ant Security Light-Year Lab CVE-2021-1843: Ye Zhang of Baidu Security ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-1885: CFF of Topsec Alpha Team ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2021-1858: Mickey Jin of Trend Micro Installer Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: This issue was addressed with improved handling of file metadata. CVE-2021-30658: Wojciech Reguła (@_r3ggi) of SecuRing Intel Graphics Driver Available for: macOS Big Sur Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2021-1841: Jack Dates of RET2 Systems, Inc. CVE-2021-1834: ABC Research s.r.o. working with Trend Micro Zero Day Initiative Kernel Available for: macOS Big Sur Impact: A malicious application may be able to disclose kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2021-1860: @0xalsr Kernel Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A memory corruption issue was addressed with improved validation. CVE-2021-1840: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab Kernel Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with kernel privileges Description: A logic issue was addressed with improved state management. CVE-2021-1851: @0xalsr Kernel Available for: macOS Big Sur Impact: Copied files may not have the expected file permissions Description: The issue was addressed with improved permissions logic. CVE-2021-1832: an anonymous researcher Kernel Available for: macOS Big Sur Impact: A malicious application may be able to disclose kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-30660: Alex Plaskett libxpc Available for: macOS Big Sur Impact: A malicious application may be able to gain root privileges Description: A race condition was addressed with additional validation. CVE-2021-30652: James Hutchins libxslt Available for: macOS Big Sur Impact: Processing a maliciously crafted file may lead to heap corruption Description: A double free issue was addressed with improved memory management. CVE-2021-1875: Found by OSS-Fuzz Login Window Available for: macOS Big Sur Impact: A malicious application with root privileges may be able to access private information Description: This issue was addressed with improved entitlements. CVE-2021-1824: Wojciech Reguła (@_r3ggi) of SecuRing Notes Available for: macOS Big Sur Impact: Locked Notes content may have been unexpectedly unlocked Description: A logic issue was addressed with improved state management. CVE-2021-1859: Syed Ali Shuja (@SyedAliShuja) of Colour King Pvt. Ltd NSRemoteView Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2021-1876: Matthew Denton of Google Chrome Preferences Available for: macOS Big Sur Impact: A local user may be able to modify protected parts of the file system Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2021-1815: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) CVE-2021-1739: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) CVE-2021-1740: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: macOS Big Sur Impact: A malicious website may be able to track users by setting state in a cache Description: An issue existed in determining cache occupancy. CVE-2021-1861: Konstantinos Solomos of University of Illinois at Chicago Safari Available for: macOS Big Sur Impact: A malicious website may be able to force unnecessary network connections to fetch its favicon Description: A logic issue was addressed with improved state management. CVE-2021-1855: Håvard Mikkelsen Ottestad of HASMAC AS SampleAnalysis Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A logic issue was addressed with improved state management. CVE-2021-1868: Tim Michaud of Zoom Communications smbx Available for: macOS Big Sur Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: An integer overflow was addressed with improved input validation. CVE-2021-1878: Aleksandar Nikolic of Cisco Talos (talosintelligence.com) System Preferences Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: A logic issue was addressed with improved state management. CVE-2021-30657: an anonymous researcher tcpdump Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: This issue was addressed with improved checks. CVE-2020-8037: an anonymous researcher Time Machine Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: The issue was addressed with improved permissions logic. CVE-2021-1839: Tim Michaud(@TimGMichaud) of Zoom Video Communications and Gary Nield of ECSC Group plc WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: An input validation issue was addressed with improved input validation. CVE-2021-1825: Alex Camboe of Aon’s Cyber Solutions WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved state management. CVE-2021-1826: an anonymous researcher WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: A memory initialization issue was addressed with improved memory handling. Apple is aware of a report that this issue may have been actively exploited. CVE-2021-30661: yangkang(@dnpushme) of 360 ATA WebRTC Available for: macOS Big Sur Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2020-7463: Megan2013678 Wi-Fi Available for: macOS Big Sur Impact: An application may be able to cause unexpected system termination or write kernel memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1828: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab Wi-Fi Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with kernel privileges Description: A type confusion issue was addressed with improved state handling. CVE-2021-1829: Tielei Wang of Pangu Lab Wi-Fi Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2021-30655: Gary Nield of ECSC Group plc and Tim Michaud(@TimGMichaud) of Zoom Video Communications and Wojciech Reguła (@_r3ggi) of SecuRing Windows Server Available for: macOS Big Sur Impact: A malicious application may be able to unexpectedly leak a user's credentials from secure text fields Description: An API issue in Accessibility TCC permissions was addressed with improved state management. CVE-2021-1873: an anonymous researcher Installation note: This update may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAmCHO0UACgkQZcsbuWJ6 jjA/XA/7BDDpbLo0btLbUrps6ELmcqFZhpvhuekw8Yd3jVeJihLcJGJpY38ZCcne srCJHuXPzlk3ex0bVkKNRrB04xF0vCA4TEBsJ495754PAKWrxmlx0Ce8zg4h+ey/ cMTaUgfB1sgOFO8kJCKJurCjhyQ3Xj5c5xa8/zxlKoAgI36PmhZsCoXC6KD+5mqn QCRF0kE/y0QSfsq13j4grLGMXLS4pkAJRMWvDiEliYDTw3pOul7ZDOwxLEyucVTv fE60H7ff7jfPbDcQ4yEgEbla40+YZYwl9Sv4zxIU2OBPva6HLbA+PXxk4F1QX7eA ECrfycMSIbQKZ2phryENZCcrX5DN4M/VcGIHq4ujF2CXBJymSWV0O5k5K0GzZ0Ko T2Zr2LOOunvHGrYy0okholNYb0iMA09dvwuDdEGr+vhLZhq1BBbmThhNEnArl7mE /fx2bvaS3o8TxGuh7mbeFK9q5Tafxe5Qhwgz9pnAtqBC8z1NgQoetk9pKPNDIsNY t3/7Xcix+fs28YOjmxPTpntud0EGSjxXm4g0bDbsU922iV1Z3ncgOvd//IzPXniS v4IqR/gPbhg+c2CGoaezD91sE5onLuMmFCogkUyftGHnN0EueKMjI+3fmyG4l4d1 0C3to6hKJNmTm56RgxwfVVOeVnsPF490s9LUYzO4ZUbaQHIuDfo= =9+Ju -----END PGP SIGNATURE----- . Accessibility Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A person with physical access to an iOS device may be able to access notes from the lock screen Description: This issue was addressed with improved checks. CVE-2021-1835: videosdebarraquito App Store Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An attacker in a privileged network position may be able to alter network traffic Description: A certificate validation issue was addressed. CVE-2021-1849: Siguza Assets Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A local user may be able to create or modify privileged files Description: A logic issue was addressed with improved restrictions. CVE-2021-1822: Bruno Virlet of The Grizzly Labs Password Manager Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A user's password may be visible on screen Description: An issue obscuring passwords in screenshots was addressed with improved logic. CVE-2021-1807: David Schütz (@xdavidhu) Shortcuts Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may allow shortcuts to access restricted files Description: The issue was addressed with improved permissions logic. CVE-2021-1868: Tim Michaud of Zoom Communications Telephony Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops. CVE-2021-1854: Steven Thorne of Cspire Wallet Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A local user may be able to view sensitive information in the app switcher Description: The issue was addressed with improved UI handling. CVE-2020-7463: Megan2013678 Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202202-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: WebkitGTK+: Multiple vulnerabilities Date: February 01, 2022 Bugs: #779175, #801400, #813489, #819522, #820434, #829723, #831739 ID: 202202-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in WebkitGTK+, the worst of which could result in the arbitrary execution of code. Background ========= WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/webkit-gtk < 2.34.4 >= 2.34.4 Description ========== Multiple vulnerabilities have been discovered in WebkitGTK+. Please review the CVE identifiers referenced below for details. Workaround ========= There is no known workaround at this time. Resolution ========= All WebkitGTK+ users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.34.4" References ========= [ 1 ] CVE-2021-30848 https://nvd.nist.gov/vuln/detail/CVE-2021-30848 [ 2 ] CVE-2021-30888 https://nvd.nist.gov/vuln/detail/CVE-2021-30888 [ 3 ] CVE-2021-30682 https://nvd.nist.gov/vuln/detail/CVE-2021-30682 [ 4 ] CVE-2021-30889 https://nvd.nist.gov/vuln/detail/CVE-2021-30889 [ 5 ] CVE-2021-30666 https://nvd.nist.gov/vuln/detail/CVE-2021-30666 [ 6 ] CVE-2021-30665 https://nvd.nist.gov/vuln/detail/CVE-2021-30665 [ 7 ] CVE-2021-30890 https://nvd.nist.gov/vuln/detail/CVE-2021-30890 [ 8 ] CVE-2021-30661 https://nvd.nist.gov/vuln/detail/CVE-2021-30661 [ 9 ] WSA-2021-0005 https://webkitgtk.org/security/WSA-2021-0005.html [ 10 ] CVE-2021-30761 https://nvd.nist.gov/vuln/detail/CVE-2021-30761 [ 11 ] CVE-2021-30897 https://nvd.nist.gov/vuln/detail/CVE-2021-30897 [ 12 ] CVE-2021-30823 https://nvd.nist.gov/vuln/detail/CVE-2021-30823 [ 13 ] CVE-2021-30734 https://nvd.nist.gov/vuln/detail/CVE-2021-30734 [ 14 ] CVE-2021-30934 https://nvd.nist.gov/vuln/detail/CVE-2021-30934 [ 15 ] CVE-2021-1871 https://nvd.nist.gov/vuln/detail/CVE-2021-1871 [ 16 ] CVE-2021-30762 https://nvd.nist.gov/vuln/detail/CVE-2021-30762 [ 17 ] WSA-2021-0006 https://webkitgtk.org/security/WSA-2021-0006.html [ 18 ] CVE-2021-30797 https://nvd.nist.gov/vuln/detail/CVE-2021-30797 [ 19 ] CVE-2021-30936 https://nvd.nist.gov/vuln/detail/CVE-2021-30936 [ 20 ] CVE-2021-30663 https://nvd.nist.gov/vuln/detail/CVE-2021-30663 [ 21 ] CVE-2021-1825 https://nvd.nist.gov/vuln/detail/CVE-2021-1825 [ 22 ] CVE-2021-30951 https://nvd.nist.gov/vuln/detail/CVE-2021-30951 [ 23 ] CVE-2021-30952 https://nvd.nist.gov/vuln/detail/CVE-2021-30952 [ 24 ] CVE-2021-1788 https://nvd.nist.gov/vuln/detail/CVE-2021-1788 [ 25 ] CVE-2021-1820 https://nvd.nist.gov/vuln/detail/CVE-2021-1820 [ 26 ] CVE-2021-30953 https://nvd.nist.gov/vuln/detail/CVE-2021-30953 [ 27 ] CVE-2021-30749 https://nvd.nist.gov/vuln/detail/CVE-2021-30749 [ 28 ] CVE-2021-30849 https://nvd.nist.gov/vuln/detail/CVE-2021-30849 [ 29 ] CVE-2021-1826 https://nvd.nist.gov/vuln/detail/CVE-2021-1826 [ 30 ] CVE-2021-30836 https://nvd.nist.gov/vuln/detail/CVE-2021-30836 [ 31 ] CVE-2021-30954 https://nvd.nist.gov/vuln/detail/CVE-2021-30954 [ 32 ] CVE-2021-30984 https://nvd.nist.gov/vuln/detail/CVE-2021-30984 [ 33 ] CVE-2021-30851 https://nvd.nist.gov/vuln/detail/CVE-2021-30851 [ 34 ] CVE-2021-30758 https://nvd.nist.gov/vuln/detail/CVE-2021-30758 [ 35 ] CVE-2021-42762 https://nvd.nist.gov/vuln/detail/CVE-2021-42762 [ 36 ] CVE-2021-1844 https://nvd.nist.gov/vuln/detail/CVE-2021-1844 [ 37 ] CVE-2021-30689 https://nvd.nist.gov/vuln/detail/CVE-2021-30689 [ 38 ] CVE-2021-45482 https://nvd.nist.gov/vuln/detail/CVE-2021-45482 [ 39 ] CVE-2021-30858 https://nvd.nist.gov/vuln/detail/CVE-2021-30858 [ 40 ] CVE-2021-21779 https://nvd.nist.gov/vuln/detail/CVE-2021-21779 [ 41 ] WSA-2021-0004 https://webkitgtk.org/security/WSA-2021-0004.html [ 42 ] CVE-2021-30846 https://nvd.nist.gov/vuln/detail/CVE-2021-30846 [ 43 ] CVE-2021-30744 https://nvd.nist.gov/vuln/detail/CVE-2021-30744 [ 44 ] CVE-2021-30809 https://nvd.nist.gov/vuln/detail/CVE-2021-30809 [ 45 ] CVE-2021-30884 https://nvd.nist.gov/vuln/detail/CVE-2021-30884 [ 46 ] CVE-2021-30720 https://nvd.nist.gov/vuln/detail/CVE-2021-30720 [ 47 ] CVE-2021-30799 https://nvd.nist.gov/vuln/detail/CVE-2021-30799 [ 48 ] CVE-2021-30795 https://nvd.nist.gov/vuln/detail/CVE-2021-30795 [ 49 ] CVE-2021-1817 https://nvd.nist.gov/vuln/detail/CVE-2021-1817 [ 50 ] CVE-2021-21775 https://nvd.nist.gov/vuln/detail/CVE-2021-21775 [ 51 ] CVE-2021-30887 https://nvd.nist.gov/vuln/detail/CVE-2021-30887 [ 52 ] CVE-2021-21806 https://nvd.nist.gov/vuln/detail/CVE-2021-21806 [ 53 ] CVE-2021-30818 https://nvd.nist.gov/vuln/detail/CVE-2021-30818 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202202-01 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

Trust: 1.98

sources: NVD: CVE-2021-1826 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-376486 // PACKETSTORM: 162370 // PACKETSTORM: 162369 // PACKETSTORM: 162358 // PACKETSTORM: 162357 // PACKETSTORM: 165794

AFFECTED PRODUCTS

vendor:applemodel:ipadosscope:ltversion:14.5

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:14.5

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:7.4

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:14.5

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.3

Trust: 1.0

sources: NVD: CVE-2021-1826

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1826
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-1980
value: MEDIUM

Trust: 0.6

VULHUB: VHN-376486
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-1826
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-376486
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1826
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-376486 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-1980 // NVD: CVE-2021-1826

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.1

sources: VULHUB: VHN-376486 // NVD: CVE-2021-1826

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202104-1980

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-376486

PATCH

title:Apple WebKitGTK+ Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=148657

Trust: 0.6

title:Apple: macOS Big Sur 11.3url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=c631c09ebe15d0799205eda727cdfeb3

Trust: 0.1

sources: VULMON: CVE-2021-1826 // CNNVD: CNNVD-202104-1980

EXTERNAL IDS

db:NVDid:CVE-2021-1826

Trust: 2.3

db:PACKETSTORMid:165794

Trust: 0.8

db:PACKETSTORMid:162357

Trust: 0.8

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:AUSCERTid:ESB-2022.0382

Trust: 0.6

db:AUSCERTid:ESB-2021.1408.2

Trust: 0.6

db:CS-HELPid:SB2021092220

Trust: 0.6

db:CS-HELPid:SB2021042801

Trust: 0.6

db:CNNVDid:CNNVD-202104-1980

Trust: 0.6

db:PACKETSTORMid:162370

Trust: 0.2

db:PACKETSTORMid:162358

Trust: 0.2

db:PACKETSTORMid:162369

Trust: 0.2

db:VULHUBid:VHN-376486

Trust: 0.1

db:VULMONid:CVE-2021-1826

Trust: 0.1

sources: VULHUB: VHN-376486 // VULMON: CVE-2021-1826 // PACKETSTORM: 162370 // PACKETSTORM: 162369 // PACKETSTORM: 162358 // PACKETSTORM: 162357 // PACKETSTORM: 165794 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-1980 // NVD: CVE-2021-1826

REFERENCES

url:https://support.apple.com/en-us/ht212317

Trust: 1.7

url:https://support.apple.com/en-us/ht212323

Trust: 1.7

url:https://support.apple.com/en-us/ht212324

Trust: 1.7

url:https://support.apple.com/en-us/ht212325

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-1826

Trust: 1.1

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021042801

Trust: 0.6

url:https://vigilance.fr/vulnerability/webkitgtk-multiple-vulnerabilities-36009

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1408.2

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0382

Trust: 0.6

url:https://packetstormsecurity.com/files/162357/apple-security-advisory-2021-04-26-1.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021092220

Trust: 0.6

url:https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-35171

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2021-1826

Trust: 0.6

url:https://packetstormsecurity.com/files/165794/gentoo-linux-security-advisory-202202-01.html

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1820

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2021-1817

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2021-1825

Trust: 0.5

url:https://support.apple.com/kb/ht201222

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1813

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1739

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1815

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1809

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1846

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1843

Trust: 0.4

url:https://www.apple.com/support/security/pgp/

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1811

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1832

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1740

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1808

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-1849

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1851

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1816

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1822

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-1860

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1857

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1864

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1814

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1875

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1858

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1807

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1868

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1844

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-1836

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-7463

Trust: 0.2

url:https://support.apple.com/kb/ht212325

Trust: 0.1

url:https://support.apple.com/kb/ht204641

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1872

Trust: 0.1

url:https://support.apple.com/ht212324.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1880

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1881

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1882

Trust: 0.1

url:https://support.apple.com/ht212323.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1840

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1828

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-8037

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1784

Trust: 0.1

url:https://support.apple.com/downloads/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1841

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1810

Trust: 0.1

url:https://support.apple.com/ht212325.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1824

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1839

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-8285

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1834

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1829

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-8286

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1848

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1837

Trust: 0.1

url:https://www.apple.com/itunes/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1854

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1835

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1830

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1852

Trust: 0.1

url:https://support.apple.com/ht212317.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1831

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30984

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30744

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30849

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30953

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30851

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30952

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30887

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30762

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30846

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2021-0005.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30884

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30858

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30682

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30897

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30936

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30663

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30954

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30890

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-42762

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30758

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30799

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30818

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-21779

Trust: 0.1

url:https://security.gentoo.org/glsa/202202-01

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-45482

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1871

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30665

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30809

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30795

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30661

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30666

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30734

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30797

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-21775

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30749

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30689

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30951

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2021-0004.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30889

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30823

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30761

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30888

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30934

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30720

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30848

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-1788

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2021-0006.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-21806

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30836

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

sources: VULHUB: VHN-376486 // VULMON: CVE-2021-1826 // PACKETSTORM: 162370 // PACKETSTORM: 162369 // PACKETSTORM: 162358 // PACKETSTORM: 162357 // PACKETSTORM: 165794 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-1980 // NVD: CVE-2021-1826

CREDITS

Apple

Trust: 1.0

sources: PACKETSTORM: 162370 // PACKETSTORM: 162369 // PACKETSTORM: 162358 // PACKETSTORM: 162357 // CNNVD: CNNVD-202104-1980

SOURCES

db:VULHUBid:VHN-376486
db:VULMONid:CVE-2021-1826
db:PACKETSTORMid:162370
db:PACKETSTORMid:162369
db:PACKETSTORMid:162358
db:PACKETSTORMid:162357
db:PACKETSTORMid:165794
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202104-1980
db:NVDid:CVE-2021-1826

LAST UPDATE DATE

2024-08-14T13:18:09.237000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-376486date:2021-09-16T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202104-1980date:2022-02-07T00:00:00
db:NVDid:CVE-2021-1826date:2021-09-16T15:53:51.573

SOURCES RELEASE DATE

db:VULHUBid:VHN-376486date:2021-09-08T00:00:00
db:PACKETSTORMid:162370date:2021-04-28T15:11:14
db:PACKETSTORMid:162369date:2021-04-28T15:10:17
db:PACKETSTORMid:162358date:2021-04-28T14:55:56
db:PACKETSTORMid:162357date:2021-04-28T14:54:48
db:PACKETSTORMid:165794date:2022-02-01T17:03:05
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202104-1980date:2021-04-27T00:00:00
db:NVDid:CVE-2021-1826date:2021-09-08T15:15:10.210