PT-2020-20932 · Apple · Libfontparser+1

Mickey Jin + 1 · Published 2020-11-12 · Updated 2021-04-09 · CVE-2021-1775

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macOS versions prior to 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave

Description The issue allows for arbitrary code execution when processing a maliciously crafted font. This is due to an integer underflow in the TTF parsing component of the libFontParser library.

Recommendations For macOS versions prior to 11.2, update to macOS Big Sur 11.2 or apply Security Update 2021-001. For Catalina, apply Security Update 2021-001. For Mojave, apply Security Update 2021-001.

Fix

Related Identifiers

CVE-2021-1775

ZDI-21-138

Affected Products

Apple Macos

Libfontparser

References · 8

• https://zerodayinitiative.com/advisories/ZDI-21-138 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1775 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1775 · Vendor Advisory
• https://support.apple.com/en-us/HT212147 · Vendor Advisory
• https://support.apple.com/en-us/103124 · Note
• https://support.apple.com/en-us/102846 · Note
• https://support.apple.com/en-us/HT211931 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1775 · Note