Vulnerability Spotlight: Vulnerability in Apple iOS, iPad OS and MacOS could lead to disclosure of sensitive memory data
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30939 | An out-of-bounds read was addressed with improved bounds checking. An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing a maliciously crafted image may lead to arbitrary code execution. NVD description · AI analysis pending | 7.8 | 4% |
| — |
Full article247 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, January 25, 2022 12:31
Jaewon Min of Cisco Talos discovered these vulnerabilities.
Cisco Talos recently discovered an out-of-bounds read vulnerability in Apple’s macOS and iOS operating systems that could lead to the disclosure of sensitive memory content. An attacker could capitalize on that information to aid in the exploitation of other vulnerabilities
This vulnerability specifically exists in the DDS image parsing functionality of Apple’s ImageIO library that exists in its desktop and mobile operating systems.
TALOS-2021-1414 (CVE-2021-30939) occurs if an attacker tricks a user into opening a specially crafted, malicious file. An attacker could exploit this vulnerability to leak the target’s heap addresses and other information that could aid in further exploitation if the leaked data can be accessed in the context of a vulnerable application.
Cisco Talos worked with Apple to ensure that this issue is resolved and an update is available for affected customers, all in adherence to Cisco’s vulnerability disclosure policy.
Users are advised to update the following software, which is tested and confirmed to be affected by this vulnerability: Apple iOS 15.1 and Apple macOS Big Sur 11.6.1. Apple also confirmed the latest release of iPad OS 15 also addresses this vulnerability.
The following SNORTⓇ rules will detect exploitation attempts against this vulnerability: 58565 and 58566. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Cisco Secure Firewall management center or Snort.org.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/vuln-spotlight-apple-ios-/