Vulnerabilidades de Apple

CVE-2022-0351 Alta · 7.8 CWE-119 25/01/2022

Access of Memory Location Before Start of Buffer in vim/vim

Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.

CVE-2021-4166 Alta · 7.1 CWE-125 25/12/2021

Out-of-bounds Read in vim/vim

vim is vulnerable to Out-of-bounds Read

CVE-2021-4136 Alta · 7.8 CWE-122 19/12/2021

Heap-based Buffer Overflow in vim/vim

vim is vulnerable to Heap-based Buffer Overflow

CVE-2021-44228 Crítica · 10.0 KEV Urgente · 100 Exploit público Ransomware CWE-20 10/12/2021

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

CVE-2021-30807 Alta · 7.8 KEV Alta · 62 Exploit público CWE-787 19/10/2021

Apple Multiple Products Memory Corruption Vulnerability

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

CVE-2021-22947 Média · 5.9 CWE-345 29/09/2021

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using...

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

CVE-2021-22946 Alta · 7.5 CWE-319 29/09/2021

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking...

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

CVE-2021-22945 Crítica · 9.1 CWE-415 23/09/2021

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances...

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

CVE-2021-39537 Alta · 8.8 CWE-787 20/09/2021

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based...

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

CVE-2021-30713 Alta · 7.8 KEV Alta · 55 CWE-862 08/09/2021

Apple macOS Unspecified Vulnerability

A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..

CVE-2021-30663 Alta · 8.8 KEV Alta · 54 CWE-190 08/09/2021

Apple Multiple Products WebKit Integer Overflow Vulnerability

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2021-30665 Alta · 8.8 KEV Alta · 54 CWE-787 08/09/2021

Apple Multiple Products WebKit Memory Corruption Vulnerability

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVE-2021-30657 Média · 5.5 KEV Urgente · 71 Exploit público CWE-862 08/09/2021

Apple macOS Unspecified Vulnerability

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..

CVE-2021-30666 Alta · 8.8 KEV Alta · 54 CWE-119 08/09/2021

Apple iOS WebKit Buffer Overflow Vulnerability

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVE-2021-30661 Alta · 8.8 KEV Alta · 55 CWE-416 08/09/2021

Apple Multiple Products WebKit Storage Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVE-2021-30761 Alta · 8.8 KEV Alta · 55 CWE-787 08/09/2021

Apple iOS WebKit Memory Corruption Vulnerability

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVE-2021-30762 Alta · 8.8 KEV Alta · 55 CWE-416 08/09/2021

Apple iOS WebKit Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVE-2021-31010 Alta · 7.5 KEV Alta · 57 CWE-502 24/08/2021

Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

CVE-2021-30983 Alta · 7.8 KEV Alta · 54 CWE-120 24/08/2021

Apple iOS and iPadOS Buffer Overflow Vulnerability

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arbitrary code with kernel privileges.

CVE-2021-30952 Alta · 7.8 KEV Alta · 55 CWE-190 24/08/2021

Apple Multiple Products Integer Overflow or Wraparound Vulnerability

An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2021-30900 Alta · 7.8 KEV Alta · 55 CWE-787 24/08/2021

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.

CVE-2021-30883 Alta · 7.8 KEV Alta · 55 CWE-787 24/08/2021

Apple Multiple Products Memory Corruption Vulnerability

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, macOS Big Sur 11.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..

CVE-2021-30869 Alta · 7.8 KEV Alta · 55 CWE-843 24/08/2021

Apple iOS, iPadOS, and macOS Type Confusion Vulnerability

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild.

CVE-2021-30860 Alta · 7.8 KEV Alta · 62 Exploit público CWE-190 24/08/2021

Apple Multiple Products Integer Overflow Vulnerability

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2021-30858 Alta · 8.8 KEV Alta · 61 Exploit público CWE-416 24/08/2021

Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.