PT-2021-5248 · Apple · Watchos+4

Mickey Jin + 1 · Published 2021-02-23 · Updated 2021-11-15 · CVE-2021-30685

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple macOS versions prior to 11.4 Apple tvOS versions prior to 14.6 Apple iOS versions prior to 14.6 Apple iPadOS versions prior to 14.6 Apple watchOS versions prior to 7.5

Description The issue is related to the AudioToolboxCore component in Apple operating systems, which can lead to an out-of-bounds read in memory when processing AAC files. This may allow an attacker to gain unauthorized access to protected information. Parsing a maliciously crafted audio file may lead to disclosure of user information.

Recommendations For Apple macOS versions prior to 11.4, update to macOS 11.4 or later. For Apple tvOS versions prior to 14.6, update to tvOS 14.6 or later. For Apple iOS versions prior to 14.6, update to iOS 14.6 or later. For Apple iPadOS versions prior to 14.6, update to iPadOS 14.6 or later. For Apple watchOS versions prior to 7.5, update to watchOS 7.5 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2021-06053

CVE-2021-30685

ZDI-21-757

Affected Products

Apple Macos

Ios

Ipados

Tvos

Watchos

References · 16

• https://support.apple.com/en-us/HT212529 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-757 · Security Note
• https://bdu.fstec.ru/vul/2021-06053 · Security Note
• https://support.apple.com/en-us/HT212533 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30685 · Security Note
• https://support.apple.com/en-us/HT212532 · Vendor Advisory
• https://support.apple.com/en-us/HT212530 · Vendor Advisory
• https://support.apple.com/en-us/HT212528 · Vendor Advisory
• https://t.me/cibsecurity/28452 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021052503 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30685 · Note
• https://t.me/cvenotify/21099 · Telegram Post
• https://t.me/cybersecuritytechnologies/4753 · Telegram Post
• https://support.apple.com/en-us/103131 · Note