cnvd - cnvd-2021-84233

cnvd-2021-84233

Vulnerability from cnvd

Title: Apple tvOS缓冲区溢出漏洞

Description:

Apple tvOS是美国苹果（Apple）公司的一套智能电视操作系统。

Apple tvOS存在缓冲区溢出漏洞。该漏洞源于内存损坏。攻击者可通过恶意制作的web内容导致代码执行。

Severity: 中

Patch Name: Apple tvOS缓冲区溢出漏洞的补丁

Patch Description:

Apple tvOS是美国苹果（Apple）公司的一套智能电视操作系统。

Apple tvOS存在缓冲区溢出漏洞。该漏洞源于内存损坏。攻击者可通过恶意制作的web内容导致代码执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://support.apple.com/en-us/HT212814

Reference: https://www.debian.org/security/2021/dsa-4995

Impacted products

Name
['Apple iPadOS 15', 'Apple Safari 15', 'Apple tvOS 15', 'Apple watchOS 8', 'Apple iOS 15']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-30851",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-30851"
    }
  },
  "description": "Apple tvOS\u662f\u7f8e\u56fd\u82f9\u679c\uff08Apple\uff09\u516c\u53f8\u7684\u4e00\u5957\u667a\u80fd\u7535\u89c6\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nApple tvOS\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5185\u5b58\u635f\u574f\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6076\u610f\u5236\u4f5c\u7684web\u5185\u5bb9\u5bfc\u81f4\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://support.apple.com/en-us/HT212814",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-84233",
  "openTime": "2021-10-29",
  "patchDescription": "Apple tvOS\u662f\u7f8e\u56fd\u82f9\u679c\uff08Apple\uff09\u516c\u53f8\u7684\u4e00\u5957\u667a\u80fd\u7535\u89c6\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nApple tvOS\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5185\u5b58\u635f\u574f\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6076\u610f\u5236\u4f5c\u7684web\u5185\u5bb9\u5bfc\u81f4\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apple tvOS\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apple iPadOS 15",
      "Apple Safari 15",
      "Apple tvOS 15",
      "Apple watchOS 8",
      "Apple iOS 15"
    ]
  },
  "referenceLink": "https://www.debian.org/security/2021/dsa-4995",
  "serverity": "\u4e2d",
  "submitTime": "2021-11-01",
  "title": "Apple tvOS\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2021-30851 (GCVE-0-2021-30851)

Vulnerability from cvelistv5

Published

2021-08-24 18:49

Modified

2024-08-03 22:48

Severity ?

CWE

Processing maliciously crafted web content may lead to code execution

Summary

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution.

References

▼	URL	Tags
	https://support.apple.com/en-us/HT212814	x_refsource_MISC
	https://support.apple.com/en-us/HT212819	x_refsource_MISC
	https://support.apple.com/en-us/HT212815	x_refsource_MISC
	https://support.apple.com/en-us/HT212816	x_refsource_MISC
	https://support.apple.com/kb/HT212869	x_refsource_CONFIRM
	https://www.debian.org/security/2021/dsa-4995	vendor-advisory, x_refsource_DEBIAN
	https://www.debian.org/security/2021/dsa-4996	vendor-advisory, x_refsource_DEBIAN
	http://www.openwall.com/lists/oss-security/2021/10/31/1	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/	vendor-advisory, x_refsource_FEDORA

Impacted products

Vendor

Product

Version

▼

Apple

iOS and iPadOS

Version: unspecified < 15

Apple	tvOS	Version: unspecified < 15
Apple	Safari	Version: unspecified < 15
Apple	watchOS	Version: unspecified < 8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:48:13.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT212814"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT212819"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT212815"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT212816"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT212869"
          },
          {
            "name": "DSA-4995",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4995"
          },
          {
            "name": "DSA-4996",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4996"
          },
          {
            "name": "[oss-security] 20211031 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/31/1"
          },
          {
            "name": "FEDORA-2021-131360fa9a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/"
          },
          {
            "name": "FEDORA-2021-483d896d1d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to code execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-19T12:06:38",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/en-us/HT212814"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/en-us/HT212819"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/en-us/HT212815"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/en-us/HT212816"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT212869"
        },
        {
          "name": "DSA-4995",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4995"
        },
        {
          "name": "DSA-4996",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4996"
        },
        {
          "name": "[oss-security] 20211031 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/31/1"
        },
        {
          "name": "FEDORA-2021-131360fa9a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/"
        },
        {
          "name": "FEDORA-2021-483d896d1d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2021-30851",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "iOS and iPadOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "15"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "tvOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "15"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Safari",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "15"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "watchOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "8"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apple"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Processing maliciously crafted web content may lead to code execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.apple.com/en-us/HT212814",
              "refsource": "MISC",
              "url": "https://support.apple.com/en-us/HT212814"
            },
            {
              "name": "https://support.apple.com/en-us/HT212819",
              "refsource": "MISC",
              "url": "https://support.apple.com/en-us/HT212819"
            },
            {
              "name": "https://support.apple.com/en-us/HT212815",
              "refsource": "MISC",
              "url": "https://support.apple.com/en-us/HT212815"
            },
            {
              "name": "https://support.apple.com/en-us/HT212816",
              "refsource": "MISC",
              "url": "https://support.apple.com/en-us/HT212816"
            },
            {
              "name": "https://support.apple.com/kb/HT212869",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT212869"
            },
            {
              "name": "DSA-4995",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4995"
            },
            {
              "name": "DSA-4996",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4996"
            },
            {
              "name": "[oss-security] 20211031 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/31/1"
            },
            {
              "name": "FEDORA-2021-131360fa9a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/"
            },
            {
              "name": "FEDORA-2021-483d896d1d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2021-30851",
    "datePublished": "2021-08-24T18:49:17",
    "dateReserved": "2021-04-13T00:00:00",
    "dateUpdated": "2024-08-03T22:48:13.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted