An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
02 Feb 2024, 03:08
Type | Values Removed | Values Added |
---|---|---|
References | () http://seclists.org/fulldisclosure/2021/Sep/25 - Mailing List, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2021/Sep/26 - Mailing List, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2021/Sep/27 - Mailing List, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2021/Sep/28 - Mailing List, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2021/Sep/38 - Mailing List, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2021/Sep/39 - Mailing List, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2021/Sep/40 - Mailing List, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2021/Sep/50 - Mailing List, Third Party Advisory | |
References | () http://www.openwall.com/lists/oss-security/2022/09/02/11 - Mailing List | |
References | () https://security.gentoo.org/glsa/202209-21 - Third Party Advisory | |
References | () https://support.apple.com/en-us/HT212804 - Vendor Advisory | |
References | () https://support.apple.com/en-us/HT212805 - Vendor Advisory | |
References | () https://support.apple.com/en-us/HT212806 - Vendor Advisory | |
References | () https://support.apple.com/en-us/HT212807 - Vendor Advisory | |
References | () https://support.apple.com/kb/HT212824 - Vendor Advisory |
07 Nov 2023, 03:33
Type | Values Removed | Values Added |
---|---|---|
References | () http://seclists.org/fulldisclosure/2021/Sep/28 - | |
References | () http://seclists.org/fulldisclosure/2021/Sep/38 - | |
References | () https://support.apple.com/en-us/HT212805 - | |
References | () http://seclists.org/fulldisclosure/2021/Sep/25 - | |
References | () http://seclists.org/fulldisclosure/2021/Sep/40 - | |
References | () http://www.openwall.com/lists/oss-security/2022/09/02/11 - | |
References | () http://seclists.org/fulldisclosure/2021/Sep/27 - | |
References | () https://support.apple.com/kb/HT212824 - | |
References | () https://security.gentoo.org/glsa/202209-21 - | |
References | () https://support.apple.com/en-us/HT212806 - | |
References | () https://support.apple.com/en-us/HT212804 - | |
References | () http://seclists.org/fulldisclosure/2021/Sep/26 - | |
References | () http://seclists.org/fulldisclosure/2021/Sep/50 - | |
References | () http://seclists.org/fulldisclosure/2021/Sep/39 - | |
References | () https://support.apple.com/en-us/HT212807 - |
30 Sep 2022, 15:05
Type | Values Removed | Values Added |
---|---|---|
References | (MLIST) http://www.openwall.com/lists/oss-security/2022/09/02/11 - Mailing List, Third Party Advisory | |
References | (GENTOO) https://security.gentoo.org/glsa/202209-21 - Third Party Advisory | |
CPE | cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:* cpe:2.3:a:xpdfreader:xpdf:*:*:*:*:*:*:*:* |
|
First Time |
Xpdfreader
Freedesktop Freedesktop poppler Xpdfreader xpdf |
29 Sep 2022, 17:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
02 Sep 2022, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
06 Apr 2022, 15:18
Type | Values Removed | Values Added |
---|---|---|
References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Sep/25 - Mailing List, Third Party Advisory | |
References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Sep/38 - Mailing List, Third Party Advisory | |
References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Sep/50 - Mailing List, Third Party Advisory | |
References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Sep/28 - Mailing List, Third Party Advisory | |
References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Sep/27 - Mailing List, Third Party Advisory | |
References | (CONFIRM) https://support.apple.com/kb/HT212824 - Vendor Advisory | |
References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Sep/39 - Mailing List, Third Party Advisory | |
References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Sep/26 - Mailing List, Third Party Advisory | |
References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Sep/40 - Mailing List, Third Party Advisory |
24 Sep 2021, 16:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
23 Sep 2021, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
22 Sep 2021, 00:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
17 Sep 2021, 22:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
14 Sep 2021, 15:42
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 7.8 |
CWE | CWE-190 | |
CPE | cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:* cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:* cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:* |
|
References |
|
|
Summary | An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. |
24 Aug 2021, 19:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-08-24 19:15
Updated : 2024-02-02 03:08
NVD link : CVE-2021-30860
Mitre link : CVE-2021-30860
CVE.ORG link : CVE-2021-30860
JSON object : View
Products Affected
xpdfreader
- xpdf
apple
- macos
- mac_os_x
- watchos
- iphone_os
- ipados
freedesktop
- poppler
CWE
CWE-190
Integer Overflow or Wraparound