CVE-2021-30942

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-30942
Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing a maliciously crafted image may lead to arbitrary code execution.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/165559/Apple-ColorSync-Out-Of-Bounds-Read.html
https://support.apple.com/en-us/HT212975
https://support.apple.com/en-us/HT212976
https://support.apple.com/en-us/HT212978
https://support.apple.com/en-us/HT212979
https://support.apple.com/en-us/HT212980
https://support.apple.com/en-us/HT212981
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
History

01 Apr 2022, 14:44

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/165559/Apple-ColorSync-Out-Of-Bounds-Read.html - (MISC) http://packetstormsecurity.com/files/165559/Apple-ColorSync-Out-Of-Bounds-Read.html - Third Party Advisory, VDB Entry

13 Jan 2022, 19:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/165559/Apple-ColorSync-Out-Of-Bounds-Read.html -

03 Jan 2022, 18:01

Type Values Removed Values Added
References (MISC) https://support.apple.com/en-us/HT212979 - (MISC) https://support.apple.com/en-us/HT212979 - Vendor Advisory
References (MISC) https://support.apple.com/en-us/HT212978 - (MISC) https://support.apple.com/en-us/HT212978 - Vendor Advisory
References (MISC) https://support.apple.com/en-us/HT212981 - (MISC) https://support.apple.com/en-us/HT212981 - Vendor Advisory
References (MISC) https://support.apple.com/en-us/HT212976 - (MISC) https://support.apple.com/en-us/HT212976 - Vendor Advisory
References (MISC) https://support.apple.com/en-us/HT212980 - (MISC) https://support.apple.com/en-us/HT212980 - Vendor Advisory
References (MISC) https://support.apple.com/en-us/HT212975 - (MISC) https://support.apple.com/en-us/HT212975 - Vendor Advisory
CPE cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
CWE CWE-787
CVSS v2 : unknown
v3 : unknown 		v2 : 6.8
v3 : 7.8

23 Dec 2021, 20:15

Type Values Removed Values Added
Summary ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none. Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing a maliciously crafted image may lead to arbitrary code execution.
References
  • (MISC) https://support.apple.com/en-us/HT212980 -
  • (MISC) https://support.apple.com/en-us/HT212979 -
  • (MISC) https://support.apple.com/en-us/HT212978 -
  • (MISC) https://support.apple.com/en-us/HT212975 -
  • (MISC) https://support.apple.com/en-us/HT212981 -
  • (MISC) https://support.apple.com/en-us/HT212976 -

24 Aug 2021, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-08-24 19:15

Updated : 2024-02-04 21:47

NVD link : CVE-2021-30942

Mitre link : CVE-2021-30942

CVE.ORG link : CVE-2021-30942

JSON object : View

Products Affected

apple

  • iphone_os
  • ipados
  • macos
  • watchos
  • mac_os_x
  • tvos
CWE
CWE-787

Out-of-bounds Write