Confirmed as exploited
CVE-2021-30952
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
01 / ACTION
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
05 / REFERENCES
Further evidence
- http://www.openwall.com/lists/oss-security/2022/01/21/2
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/
- https://support.apple.com/en-us/HT212975
- https://support.apple.com/en-us/HT212976
- https://support.apple.com/en-us/HT212978
- https://support.apple.com/en-us/HT212980
- https://support.apple.com/en-us/HT212982
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952
- https://www.debian.org/security/2022/dsa-5060
- https://www.debian.org/security/2022/dsa-5061