CVE-2021-30858

high-risk

Published 2021-08-24

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Do I need to act?

0.79% chance of exploitation

EPSS score — low exploit probability

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (7)

Ipados

Iphone Os

Macos

Fedora

Debian Linux

Affected Vendors

Debian Apple Fedoraproject

References (37)

Mailing List http://seclists.org/fulldisclosure/2021/Sep/25

Mailing List http://seclists.org/fulldisclosure/2021/Sep/27

Mailing List http://seclists.org/fulldisclosure/2021/Sep/29

Mailing List http://seclists.org/fulldisclosure/2021/Sep/38

Mailing List http://seclists.org/fulldisclosure/2021/Sep/39

Mailing List http://seclists.org/fulldisclosure/2021/Sep/50

Mailing List http://www.openwall.com/lists/oss-security/2021/09/20/1

Mailing List http://www.openwall.com/lists/oss-security/2021/10/26/9

Mailing List http://www.openwall.com/lists/oss-security/2021/10/27/1

Mailing List http://www.openwall.com/lists/oss-security/2021/10/27/2

Mailing List http://www.openwall.com/lists/oss-security/2021/10/27/4

Release Notes https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://support.apple.com/en-us/HT212804

Third Party Advisory https://support.apple.com/en-us/HT212807

Third Party Advisory https://support.apple.com/kb/HT212824

Mailing List https://www.debian.org/security/2021/dsa-4975

Mailing List https://www.debian.org/security/2021/dsa-4976

Mailing List http://seclists.org/fulldisclosure/2021/Sep/25

Mailing List http://seclists.org/fulldisclosure/2021/Sep/27

and 17 more references

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 10/34 · Low

Exposure 14/34 · Moderate