Buffer overflow in macOS - CVE-2021-30779
Published: July 22, 2021
Vulnerability identifier: #VU55204
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-30779
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing image files in ImageIO. A remote attacker can create a specially crafted image, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
macOS
watchOS
tvOS
iPadOS
Apple iOS
iCloud for Windows
iTunes
watchOS
tvOS
iPadOS
Apple iOS
iCloud for Windows
iTunes
How to mitigate CVE-2021-30779
Install updates from vendor's website.
macOS - update to 11.5 20G71
watchOS - update to 7.6 18U63
iCloud for Windows - update to 12.5
iTunes - update to 12.11.4
tvOS - update to 14.7 18M60
iPadOS - addressed in versions 14.7 18G69, 14.7 18G70
Apple iOS - update to 14.7 18G69
watchOS - update to 7.6 18U63
iCloud for Windows - update to 12.5
iTunes - update to 12.11.4
tvOS - update to 14.7 18M60
iPadOS - addressed in versions 14.7 18G69, 14.7 18G70
Apple iOS - update to 14.7 18G69