CVE Vulnerability Advisory Database

[Affected Scope] Apple iOS before 14.4, iPadOS before 14.4, macOS Big Sur before 11.2, and macOS Catalina/Mojave prior to Security Update 2021-001.

[Impact] A remote attacker can execute arbitrary code on the target device via malicious web content, bypassing sandbox restrictions. This vulnerability has been actively exploited in the wild.

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to iOS/iPadOS 14.4, macOS Big Sur 11.2, or later.

[Affected Scope] Systems running macOS Big Sur prior to 11.2, Catalina/Mojave without Security Update 2021-001, iOS/iPadOS prior to 14.4, tvOS prior to 14.4, watchOS prior to 7.3, and Safari prior to 14.0.3

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) within the context of the browser process

[Mitigation] Immediately apply official Apple software updates to upgrade to patched versions (macOS 11.2, iOS 14.4, Safari 14.0.3, etc.)

[Affected Scope] Apple devices running iOS versions prior to 14.4, iPadOS prior to 14.4, macOS Big Sur prior to 11.2, watchOS prior to 7.3, and tvOS prior to 14.4

[Impact] A local attacker can execute a malicious application to trigger a race condition in the kernel, leading to full kernel privilege escalation and complete device compromise

[Mitigation] Immediately update all affected Apple operating systems to the latest patched versions (iOS/iPadOS 14.4, macOS Big Sur 11.2, or later)

[Affected Scope] Apple devices running macOS Big Sur prior to 11.0.1, iOS/iPadOS prior to 14.2, and watchOS prior to 7.1

[Impact] A local attacker can execute a malicious application to disclose sensitive kernel memory, allowing them to bypass Kernel Address Space Layout Randomization (KASLR) and facilitate subsequent privilege escalation

[Mitigation] Apply the official security updates provided by Apple to upgrade the operating system to the latest patched version

[Affected Scope] Systems running macOS Big Sur prior to 11.0.1, iOS/iPadOS prior to 14.2, iOS prior to 12.4.9, and watchOS prior to 7.1

[Impact] A local malicious application can exploit a type confusion vulnerability within the XNU kernel's Turnstiles mechanism to execute arbitrary code with kernel privileges

[Mitigation] Apply the official security updates provided by Apple to upgrade the operating system to the patched versions

[Affected Scope] Legacy Apple operating systems prior to iOS 14.2, macOS Catalina 10.15.7, and watchOS 7.1

[Impact] Processing a maliciously crafted font file triggers an out-of-bounds write (CWE-787), leading to arbitrary remote code execution (RCE)

[Mitigation] Immediately apply the official security patches provided by Apple (iOS 14.2, macOS Big Sur 11.0.1, or later)

[Affected Scope] Apple iOS and iPadOS versions prior to 13.6, and macOS Catalina versions prior to 10.15.6

[Impact] A local attacker can exploit improper validation of environment variables to bypass security boundaries and view sensitive user information

[Mitigation] Immediately update affected devices to iOS/iPadOS 13.6, macOS Catalina 10.15.6, or later versions

[Affected Scope] Devices running iOS/iPadOS versions prior to 13.5.1, macOS Catalina prior to 10.15.5 Supplemental Update, tvOS prior to 13.4.6, and watchOS prior to 6.2.6

[Impact] A local application can exploit this vulnerability to execute arbitrary code with elevated kernel privileges, completely compromising the operating system

[Mitigation] Immediately apply the official Apple security updates to transition to iOS/iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, or later

[Affected Scope] VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1), and Horizon Client for Mac (5.x and prior before 5.4.0)

[Impact] Local attackers with standard user privileges can exploit improper setuid binary execution to escalate privileges to root, gaining full administrative control over the macOS system

[Mitigation] Immediately upgrade to the patched versions (Fusion 11.5.2+, VMRC 11.0.1+, Horizon Client 5.4.0+) or restrict setuid permissions on vulnerable binaries

[Affected Scope] Apple iOS before 13.3.1, iPadOS before 13.3.1, macOS Catalina before 10.15.3, tvOS before 13.3.1, and watchOS before 6.1.2

[Impact] A local application may exploit this vulnerability to execute arbitrary code with elevated kernel privileges, leading to complete system compromise

[Mitigation] Immediately apply the official software updates provided by Apple to patch the affected systems

[Affected Scope] Apple iOS versions prior to 12.3, macOS Mojave prior to 10.14.5, tvOS prior to 12.3, and watchOS prior to 5.2.1

[Impact] A local malicious application can exploit this vulnerability to execute arbitrary code with elevated system/kernel privileges

[Mitigation] Immediately upgrade to patched OS versions (iOS 12.3, macOS 10.14.5, tvOS 12.3, watchOS 5.2.1 or later)

[Affected Scope] All Apple Mac systems running macOS Mojave versions prior to 10.14.4

[Impact] A local attacker can execute a malicious application to gain elevated kernel privileges and fully compromise the system

[Mitigation] Immediately apply the official operating system security update to macOS Mojave 10.14.4 or later

[Affected Scope] Apple iOS devices prior to version 12.1.4 and macOS Mojave systems prior to 10.14.3 Supplemental Update

[Impact] A local application can exploit a memory corruption vulnerability to bypass sandboxing and gain elevated system privileges

[Mitigation] Immediately apply the official security patches (iOS 12.1.4, macOS 10.14.3 Supplemental Update, or later)

[Affected Scope] Apple operating systems prior to iOS 12, macOS Mojave 10.14, tvOS 12, and watchOS 5

[Impact] Local attackers or malicious applications can trigger memory corruption to execute arbitrary code with kernel privileges, leading to complete system compromise

[Mitigation] Immediately update affected devices to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, or later versions

[Affected Scope] Apple iOS devices running versions 12.1 through 12.1.3, and macOS Mojave systems prior to 10.14.3 Supplemental Update

[Impact] A remote attacker initiating a Group FaceTime call can force the recipient's device to transmit audio and video before the recipient answers the call, leading to unauthorized surveillance

[Mitigation] Immediately upgrade to iOS 12.1.4 or later, and apply the macOS Mojave 10.14.3 Supplemental Update