PT-2021-6502 · Apple+5 · Ios+5

Bianliang + 2 · Published 2019-11-04 · Updated 2025-10-23 · CVE-2021-30666

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 12.5.3

Description A buffer overflow issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Recommendations For versions prior to 12.5.3, update to iOS 12.5.3 to resolve the issue. As a temporary workaround, consider avoiding the processing of maliciously crafted web content until the update is applied.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

CWE-119

Related Identifiers

ALSA-2020:4451

ALSA-2020_4451

BDU:2022-01759

CESA-2020_4035

CESA-2020_4451

CVE-2021-30666

DSA-4558-1

OPENSUSE-SU-2022:0182-1

OPENSUSE-SU-2022_0182-1

OPENSUSE-SU-2022_0182-2

OPENSUSE-SU-2024:11506-1

RHSA-2020:4035

RHSA-2020:4451

RHSA-2020_4035

RHSA-2020_4451

RHSA-2025:10364

RLSA-2020:4451

RLSA-2020_4451

SUSE-SU-2022:0142-1

SUSE-SU-2022:0182-1

SUSE-SU-2022:0182-2

SUSE-SU-2022:0183-1

Affected Products

Almalinux

Centos

Red Hat

Rocky Linux

Suse

Ios

References · 374

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/safari_in_operator_side_effect.rb · Exploit
• 🔥 https://github.com/BadAccess11/CVE-2019-8601 · Exploit
• 🔥❌ https://github.com/PeterMxx/ps4_8.00_vuln_poc · Exploit, Deleted
• https://support.apple.com/en-us/HT212341 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4451 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-30666 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4558-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30666 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30666 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30666 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0182-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11506-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0183-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-30666 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-30666 · Vendor Advisory