CVE Vulnerability Advisory Database

[Affected Scope] Apple iOS before 14.4, iPadOS before 14.4, macOS Big Sur before 11.2, and macOS Catalina/Mojave prior to Security Update 2021-001.

[Impact] A remote attacker can execute arbitrary code on the target device via malicious web content, bypassing sandbox restrictions. This vulnerability has been actively exploited in the wild.

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to iOS/iPadOS 14.4, macOS Big Sur 11.2, or later.

[Affected Scope] Systems running macOS Big Sur prior to 11.2, Catalina/Mojave without Security Update 2021-001, iOS/iPadOS prior to 14.4, tvOS prior to 14.4, watchOS prior to 7.3, and Safari prior to 14.0.3

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) within the context of the browser process

[Mitigation] Immediately apply official Apple software updates to upgrade to patched versions (macOS 11.2, iOS 14.4, Safari 14.0.3, etc.)

[Affected Scope] Apple devices running iOS versions prior to 14.4, iPadOS prior to 14.4, macOS Big Sur prior to 11.2, watchOS prior to 7.3, and tvOS prior to 14.4

[Impact] A local attacker can execute a malicious application to trigger a race condition in the kernel, leading to full kernel privilege escalation and complete device compromise

[Mitigation] Immediately update all affected Apple operating systems to the latest patched versions (iOS/iPadOS 14.4, macOS Big Sur 11.2, or later)

[Affected Scope] Apple devices running macOS Big Sur prior to 11.0.1, iOS/iPadOS prior to 14.2, and watchOS prior to 7.1

[Impact] A local attacker can execute a malicious application to disclose sensitive kernel memory, allowing them to bypass Kernel Address Space Layout Randomization (KASLR) and facilitate subsequent privilege escalation

[Mitigation] Apply the official security updates provided by Apple to upgrade the operating system to the latest patched version

[Affected Scope] Systems running macOS Big Sur prior to 11.0.1, iOS/iPadOS prior to 14.2, iOS prior to 12.4.9, and watchOS prior to 7.1

[Impact] A local malicious application can exploit a type confusion vulnerability within the XNU kernel's Turnstiles mechanism to execute arbitrary code with kernel privileges

[Mitigation] Apply the official security updates provided by Apple to upgrade the operating system to the patched versions

[Affected Scope] Legacy Apple operating systems prior to iOS 14.2, macOS Catalina 10.15.7, and watchOS 7.1

[Impact] Processing a maliciously crafted font file triggers an out-of-bounds write (CWE-787), leading to arbitrary remote code execution (RCE)

[Mitigation] Immediately apply the official security patches provided by Apple (iOS 14.2, macOS Big Sur 11.0.1, or later)

[Affected Scope] Apple iOS and iPadOS versions prior to 13.6, and macOS Catalina versions prior to 10.15.6

[Impact] A local attacker can exploit improper validation of environment variables to bypass security boundaries and view sensitive user information

[Mitigation] Immediately update affected devices to iOS/iPadOS 13.6, macOS Catalina 10.15.6, or later versions

[Affected Scope] Apple devices running iOS versions prior to 13.6, iPadOS versions prior to 13.6, and tvOS versions prior to 13.4.8

[Impact] A local application can exploit a memory corruption vulnerability to execute arbitrary code with kernel privileges

[Mitigation] Immediately update affected devices to iOS 13.6, iPadOS 13.6, tvOS 13.4.8 or later

[Affected Scope] Apple Mail client running on iOS versions prior to 13.5, iOS prior to 12.4.7, and watchOS versions prior to 6.2.5 and 5.3.7

[Impact] Processing a maliciously crafted email message can trigger heap corruption and excessive memory consumption, leading to mail application crashes or Denial of Service (DoS)

[Mitigation] Immediately apply official Apple software updates to upgrade to iOS/iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7, or later

[Affected Scope] Apple iOS and iPadOS versions prior to 13.5, iOS versions prior to 12.4.7, and watchOS versions prior to 6.2.5

[Impact] Processing a maliciously crafted email message can trigger unexpected memory modification or application termination, potentially leading to remote code execution (RCE)

[Mitigation] Immediately update affected devices to iOS/iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, or later

[Affected Scope] Devices running iOS/iPadOS versions prior to 13.5.1, macOS Catalina prior to 10.15.5 Supplemental Update, tvOS prior to 13.4.6, and watchOS prior to 6.2.6

[Impact] A local application can exploit this vulnerability to execute arbitrary code with elevated kernel privileges, completely compromising the operating system

[Mitigation] Immediately apply the official Apple security updates to transition to iOS/iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, or later

[Affected Scope] Apple iOS before 13.3.1, iPadOS before 13.3.1, macOS Catalina before 10.15.3, tvOS before 13.3.1, and watchOS before 6.1.2

[Impact] A local application may exploit this vulnerability to execute arbitrary code with elevated kernel privileges, leading to complete system compromise

[Mitigation] Immediately apply the official software updates provided by Apple to patch the affected systems

[Affected Scope] Apple iOS versions prior to 12.3, macOS Mojave prior to 10.14.5, tvOS prior to 12.3, and watchOS prior to 5.2.1

[Impact] A local malicious application can exploit this vulnerability to execute arbitrary code with elevated system/kernel privileges

[Mitigation] Immediately upgrade to patched OS versions (iOS 12.3, macOS 10.14.5, tvOS 12.3, watchOS 5.2.1 or later)

[Affected Scope] Systems running versions prior to iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, and iCloud for Windows 7.11

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) on the target system

[Mitigation] Immediately update all affected operating systems and applications to their latest patched versions

[Affected Scope] All Apple iOS and iPadOS devices running versions prior to iOS 12.1.4

[Impact] Local attackers can execute arbitrary code with kernel privileges, leading to complete device compromise; actively exploited in the wild

[Mitigation] Immediately update affected devices to iOS 12.1.4 or later

[Affected Scope] Apple iOS devices prior to version 12.1.4 and macOS Mojave systems prior to 10.14.3 Supplemental Update

[Impact] A local application can exploit a memory corruption vulnerability to bypass sandboxing and gain elevated system privileges

[Mitigation] Immediately apply the official security patches (iOS 12.1.4, macOS 10.14.3 Supplemental Update, or later)

[Affected Scope] Apple operating systems prior to iOS 12, macOS Mojave 10.14, tvOS 12, and watchOS 5

[Impact] Local attackers or malicious applications can trigger memory corruption to execute arbitrary code with kernel privileges, leading to complete system compromise

[Mitigation] Immediately update affected devices to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, or later versions

[Affected Scope] Apple iOS devices running versions 12.1 through 12.1.3, and macOS Mojave systems prior to 10.14.3 Supplemental Update

[Impact] A remote attacker initiating a Group FaceTime call can force the recipient's device to transmit audio and video before the recipient answers the call, leading to unauthorized surveillance

[Mitigation] Immediately upgrade to iOS 12.1.4 or later, and apply the macOS Mojave 10.14.3 Supplemental Update

[Affected Scope] Cisco devices running Cisco IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later with Login Enhancements (Login Block) enabled

[Impact] An unauthenticated, remote attacker can trigger an unexpected system reload, leading to a complete Denial of Service (DoS) condition

[Mitigation] Apply the official Cisco IOS software updates, or temporarily disable the 'login block-for' feature and restrict virtual terminal (vty) access using infrastructure ACLs

[Affected Scope] Cisco devices running Cisco IOS Software Releases 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later with Login Enhancements (Login Block) enabled

[Impact] An unauthenticated, remote attacker can trigger an unexpected system reload, leading to a persistent Denial of Service (DoS) condition

[Mitigation] Upgrade to the latest patched Cisco IOS software release or temporarily disable/modify the Login Block configuration