PT-2021-18819 · Apple · Ios+2

Mickey Jin + 1 · Published 2021-05-24 · Updated 2022-07-12 · CVE-2021-30709

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 11.4 Security Update versions prior to 2021-003 on Catalina Security Update versions prior to 2021-004 on Mojave iOS versions prior to 14.6 iPadOS versions prior to 14.6

Description The issue is related to processing maliciously crafted USD files, which may disclose memory contents. This is due to inadequate checks that have been improved in the fixed versions.

Recommendations For macOS versions prior to 11.4, update to macOS Big Sur 11.4. For Security Update versions prior to 2021-003 on Catalina, apply Security Update 2021-003. For Security Update versions prior to 2021-004 on Mojave, apply Security Update 2021-004. For iOS versions prior to 14.6, update to iOS 14.6. For iPadOS versions prior to 14.6, update to iPadOS 14.6.

Fix

Related Identifiers

CVE-2021-30709

ZDI-21-766

Affected Products

Apple Macos

Ios

Ipados

References · 10

• https://zerodayinitiative.com/advisories/ZDI-21-766 · Security Note
• https://support.apple.com/en-us/HT212528 · Vendor Advisory
• https://support.apple.com/en-us/HT212530 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30709 · Security Note
• https://support.apple.com/en-us/HT212529 · Vendor Advisory
• https://support.apple.com/en-us/HT212531 · Vendor Advisory
• https://support.apple.com/en-us/103131 · Note
• https://t.me/cibsecurity/28455 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30709 · Note