CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-30661 – Apple Multiple Products WebKit Storage Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2021-30661
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.. Se abordó un problema de uso de la memoria previamente liberada con una administración de la memoria mejorada. • https://support.apple.com/en-us/HT212317 https://support.apple.com/en-us/HT212318 https://support.apple.com/en-us/HT212323 https://support.apple.com/en-us/HT212324 https://support.apple.com/en-us/HT212325 https://support.apple.com/en-us/HT212341 https://access.redhat.com/security/cve/CVE-2021-30661 https://bugzilla.redhat.com/show_bug.cgi?id=1986870 • CWE-20: Improper Input Validation CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-30663 – Apple Multiple Products WebKit Integer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2021-30663
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Se abordó un desbordamiento de enteros con una comprobación de entrada mejorada. Este problema es corregido en iOS versión 14.5.1 y iPadOS versión 14.5.1, tvOS versión 14.6, iOS versión 12.5.3, Safari versión 14.1.1, macOS Big Sur versión 11.3.1. • https://support.apple.com/en-us/HT212335 https://support.apple.com/en-us/HT212336 https://support.apple.com/en-us/HT212341 https://support.apple.com/en-us/HT212532 https://support.apple.com/en-us/HT212534 https://access.redhat.com/security/cve/CVE-2021-30663 https://bugzilla.redhat.com/show_bug.cgi?id=1986872 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-1825 – webkitgtk: Input validation issue leading to cross site scripting attack
https://notcve.org/view.php?id=CVE-2021-1825
An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting attack. Se abordó un problema de comprobación de entradas con una comprobación de entrada mejorada. Este problema se corrigió en iTunes versión 12.11.3 para Windows, iCloud para Windows versión 12.3, macOS Big Sur versión 11.3, Safari versión 14.1, watchOS versión 7.4, tvOS versión 14.5, iOS versión 14.5 e iPadOS versión 14.5. • https://support.apple.com/en-us/HT212317 https://support.apple.com/en-us/HT212318 https://support.apple.com/en-us/HT212319 https://support.apple.com/en-us/HT212321 https://support.apple.com/en-us/HT212323 https://support.apple.com/en-us/HT212324 https://support.apple.com/en-us/HT212325 https://access.redhat.com/security/cve/CVE-2021-1825 https://bugzilla.redhat.com/show_bug.cgi?id=1986858 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2021-1799 – webkitgtk: Access to restricted ports on arbitrary servers via port redirection
https://notcve.org/view.php?id=CVE-2021-1799
A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on arbitrary servers. Se abordó un problema de redirección de puertos con una comprobación de puertos adicional. Este problema es corregido en macOS Big Sur versión 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS versión 14.4, watchOS versión 7.3, iOS versión 14.4 y iPadOS versión 14.4, Safari versión 14.0.3. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU https://security.gentoo.org/glsa/202104-03 https://support.apple.com/en-us/HT212146 https://support.apple.com/en-us/HT212147 https://support.apple.com/en-us/HT212148 https://support.apple.com/en-us/HT212149 https://support.apple.com/en-us/HT212152 https:/&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 34EXPL: 0CVE-2020-7463
https://notcve.org/view.php?id=CVE-2020-7463
In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handling in the kernel causes a use-after-free bug by sending large user messages from multiple threads on the same SCTP socket. The use-after-free situation may result in unintended kernel behaviour including a kernel panic. En FreeBSD versiones 12.1-STABLE anteriores a r364644, 11.4-STABLE anteriores a r364651, 12.1-RELEASE anteriores a p9, 11.4-RELEASE anteriores a p3 y 11.3-RELEASE anteriores a p13, el manejo inapropiado en el kernel causa un bug de uso de la memoria previamente liberada mediante el envío de mensajes de usuario grandes de múltiples subprocesos en el mismo socket SCTP. La situación del uso de la memoria previamente liberada puede resultar en un comportamiento del kernel no deseado, incluyendo un pánico del kernel. • http://seclists.org/fulldisclosure/2021/Apr/49 http://seclists.org/fulldisclosure/2021/Apr/50 http://seclists.org/fulldisclosure/2021/Apr/57 http://seclists.org/fulldisclosure/2021/Apr/58 http://seclists.org/fulldisclosure/2021/Apr/59 https://security.FreeBSD.org/advisories/FreeBSD-SA-20:25.sctp.asc https://support.apple.com/kb/HT212317 https://support.apple.com/kb/HT212318 https://support.apple.com/kb/HT212319 https://support.apple.com/kb/HT212321 https://support.app • CWE-416: Use After Free •