Use-after-free in iPadOS and Apple iOS - CVE-2021-1864

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU52682

Use-after-free in iPadOS and Apple iOS - CVE-2021-1864

Published: April 28, 2021


Vulnerability identifier: #VU52682
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-1864
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing JavaScript in iTunes Store. A remote attacker can use a specially crafted JavaScript to trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Affected software

iPadOS
Apple iOS
watchOS
tvOS

How to mitigate CVE-2021-1864

Install updates from vendor's website.

iPadOS - update to 14.5 18E199
Apple iOS - update to 14.5 18E199
watchOS - update to 7.4 18T195
tvOS - update to 14.5 18L204

External References

Related Security Bulletins