Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Local
0

CVE-2021-30849

Disclosure Date: October 19, 2021 •
CVE-2021-30849 CVSS v3 Base Score: 7.8
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
iOS and iPadOS 14.8
iOS and iPadOS 15
tvOS 15
Safari 15
iTunes for Windows 12.12
watchOS 8
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • apple

Products

  • ipados,
  • iphone os,
  • itunes,
  • macos,
  • safari,
  • tvos,
  • watchos

References

Canonical
CVE-2021-30849 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30849)
Advisory
[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (http://www.openwall.com/lists/oss-security/2021/10/26/9)
[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (http://www.openwall.com/lists/oss-security/2021/10/27/1)
[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (http://www.openwall.com/lists/oss-security/2021/10/27/2)
20211027 APPLE-SA-2021-10-26-8 Additional information for APPLE-SA-2021-09-20-5 Safari 15 (http://seclists.org/fulldisclosure/2021/Oct/60)
20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8 (http://seclists.org/fulldisclosure/2021/Oct/62)
20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15 (http://seclists.org/fulldisclosure/2021/Oct/63)
20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15 (http://seclists.org/fulldisclosure/2021/Oct/61)
[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (http://www.openwall.com/lists/oss-security/2021/10/27/4)
https://support.apple.com/kb/HT212953
https://support.apple.com/kb/HT212869
Miscellaneous
https://support.apple.com/en-us/HT212807
https://support.apple.com/en-us/HT212814
https://support.apple.com/en-us/HT212819
https://support.apple.com/en-us/HT212815
https://support.apple.com/en-us/HT212817
https://support.apple.com/en-us/HT212816

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis