Buffer overflow in macOS - CVE-2021-30917
Published: October 27, 2021
Vulnerability identifier: #VU57712
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-30917
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing ICC profiles in ColorSync subsystem. A remote attacker can create a specially crafted image, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
macOS
watchOS
tvOS
iPadOS
Apple iOS
watchOS
tvOS
iPadOS
Apple iOS
How to mitigate CVE-2021-30917
Install updates from vendor's website.
macOS - addressed in versions 11.6.1 20G224, 10.15.7 19H1519, 12.0.1 21A559
watchOS - update to 8.1 19R570
tvOS - update to 15.1 19J572
iPadOS - addressed in versions 14.8.1 18H107, 15.1 19B74, 15.1 19B75
Apple iOS - addressed in versions 14.8.1 18H107, 15.1 19B74
watchOS - update to 8.1 19R570
tvOS - update to 15.1 19J572
iPadOS - addressed in versions 14.8.1 18H107, 15.1 19B74, 15.1 19B75
Apple iOS - addressed in versions 14.8.1 18H107, 15.1 19B74
External References
Related Security Bulletins
- Multiple vulnerabilities in macOS Big Sur
- Multiple vulnerabilities in macOS Catalina
- Multiple vulnerabilities in macOS Monterey
- Multiple vulnerabilities in Apple iOS 15 and iPadOS 15
- Multiple vulnerabilities in Apple iOS 14 and iPadOS 14
- Multiple vulnerabilities in Apple watchOS
- Multiple vulnerabilities in Apple tvOS