Apple · Multiple Products
CVE-2021-30860
Apple Multiple Products Integer Overflow Vulnerability
ما هي
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CISA: Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.
ما العمل
Apply updates per vendor instructions.
الموعد النهائي للوكالات الفدرالية الأمريكية: 17 نوفمبر 2021
- أُضيفت إلى قائمة CISA
- 3 نوفمبر 2021
- نُشرت
- 24 أغسطس 2021
- الخطورة
- مرتفع 7.8 CVSS 3.1
- احتمال الهجمات خلال الأيام الـ30 القادمة (EPSS)
- 76% ضمن أعلى 0.5% من كل الثغرات المعروفة
- نوع الضعف
- CWE-20 CWE-190
- تفاصيل أكثر
- NVD · CVE.org · CISA
كل المراجع (15)
- https://security.gentoo.org/glsa/202209-21
- https://support.apple.com/en-us/HT212804
- https://support.apple.com/en-us/HT212805
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212806
- http://seclists.org/fulldisclosure/2021/Sep/28
- http://seclists.org/fulldisclosure/2021/Sep/27
- http://seclists.org/fulldisclosure/2021/Sep/25
- http://seclists.org/fulldisclosure/2021/Sep/26
- http://seclists.org/fulldisclosure/2021/Sep/40
- http://seclists.org/fulldisclosure/2021/Sep/38
- http://seclists.org/fulldisclosure/2021/Sep/39
- https://support.apple.com/kb/HT212824
- http://seclists.org/fulldisclosure/2021/Sep/50
- http://www.openwall.com/lists/oss-security/2022/09/02/11
ثغرات مُستغلّة أخرى من Apple
| أُضيفت | الثغرة | المنتج | الخطورة | احتمال الهجوم |
|---|---|---|---|---|
| 29/09/2026 | Out-of-Bounds Write | Multiple Products | مرتفع 8.8 | 26% |
| 20/03/2026 | Buffer Overflow | Multiple Products | مرتفع 8.8 | 1.7% |
| 20/03/2026 | Improper Locking | Multiple Products | مرتفع 7.8 | 0.4% |
| 20/03/2026 | Classic Buffer Overflow | Multiple Products | متوسطة 5.5 | 0.4% |
| 05/03/2026 | Integer Overflow or Wraparound | Multiple Products | مرتفع 8.8 | 7.0% |
| 05/03/2026 | Use-After-Free | Multiple Products | مرتفع 8.8 | 4.0% |
| 12/02/2026 | Multiple Buffer Overflow | Multiple Products | مرتفع 7.8 | 1.7% |
| 15/12/2025 | Use-After-Free WebKit | Multiple Products | مرتفع 8.8 | 26% |
المصادر: Known Exploited Vulnerabilities (CISA، ملكية عامة)، وCVE records (cve.org)، وEPSS (FIRST). احتمال الهجوم هو تقدير EPSS لاحتمال أن يحاول أحد استغلال الثغرة خلال الأيام الـ30 القادمة.