CVE-2021-30860

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
appleCNA
---
---
CVEADP
---
---
CISA-ADPADP
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
appleipados
𝑥
< 14.8
appleiphone_os
𝑥
< 12.5.5
appleiphone_os
13.0 ≤
𝑥
< 14.8
applemac_os_x
10.15 ≤
𝑥
< 10.15.7
applemac_os_x
10.15.7
applemac_os_x
10.15.7:security_update_2020
applemac_os_x
10.15.7:security_update_2020-001
applemac_os_x
10.15.7:security_update_2021-001
applemac_os_x
10.15.7:security_update_2021-002
applemac_os_x
10.15.7:security_update_2021-003
applemac_os_x
10.15.7:security_update_2021-004
applemacos
𝑥
< 11.6
applewatchos
𝑥
< 7.6.2
xpdfreaderxpdf
𝑥
< 4.04
freedesktoppoppler
𝑥
< 22.09.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2021/Sep/25
http://seclists.org/fulldisclosure/2021/Sep/26
http://seclists.org/fulldisclosure/2021/Sep/27
http://seclists.org/fulldisclosure/2021/Sep/28
http://seclists.org/fulldisclosure/2021/Sep/38
http://seclists.org/fulldisclosure/2021/Sep/39
http://seclists.org/fulldisclosure/2021/Sep/40
http://seclists.org/fulldisclosure/2021/Sep/50
http://www.openwall.com/lists/oss-security/2022/09/02/11
https://security.gentoo.org/glsa/202209-21
https://support.apple.com/en-us/HT212804
https://support.apple.com/en-us/HT212805
https://support.apple.com/en-us/HT212806
https://support.apple.com/en-us/HT212807
https://support.apple.com/kb/HT212824
http://seclists.org/fulldisclosure/2021/Sep/25
http://seclists.org/fulldisclosure/2021/Sep/26
http://seclists.org/fulldisclosure/2021/Sep/27
http://seclists.org/fulldisclosure/2021/Sep/28
http://seclists.org/fulldisclosure/2021/Sep/38
http://seclists.org/fulldisclosure/2021/Sep/39
http://seclists.org/fulldisclosure/2021/Sep/40
http://seclists.org/fulldisclosure/2021/Sep/50
http://www.openwall.com/lists/oss-security/2022/09/02/11
https://security.gentoo.org/glsa/202209-21
https://support.apple.com/en-us/HT212804
https://support.apple.com/en-us/HT212805
https://support.apple.com/en-us/HT212806
https://support.apple.com/en-us/HT212807
https://support.apple.com/kb/HT212824
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30860