CVE-2021-30860: Apple Multiple Products Integer Overflow Vulnerability

Q: What is CVE-2021-30860?

CVE-2021-30860 is an integer overflow vulnerability in Apple iOS, iPadOS, macOS, and watchOS CoreGraphics that allows code execution when processing a maliciously crafted PDF.

Q: How can the CVE-2021-30860 vulnerability be exploited?

The CVE-2021-30860 vulnerability can be exploited by processing a specially crafted PDF file.

Q: Which Apple products are affected by CVE-2021-30860?

Apple iOS, iPadOS, macOS, and watchOS are affected by CVE-2021-30860.

Q: What is the severity of CVE-2021-30860?

The severity of CVE-2021-30860 is not specified in the provided information.

Q: How can I fix the CVE-2021-30860 vulnerability?

To fix the CVE-2021-30860 vulnerability, update to the recommended versions of Apple iOS, iPadOS, macOS, and watchOS as provided by Apple.

Published Aug 24, 2021

Updated

CoreGraphics. An integer overflow was addressed with improved input validation.

Other sources

Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.

— CISA

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Credit

The Citizen Lab, The Citizen Lab, The Citizen Lab, The Citizen Lab, The Citizen Lab

Affected Software

22 affected componentsFixes available

Apple macOS Big Sur<11.6

11.6

Apple Catalina

Apple WatchOS<7.6.2

7.6.2

Apple iOS<12.5.5

12.5.5

Apple Multiple Products

Apple iOS<14.8

14.8

Apple iPadOS<14.8

14.8

Apple iPadOS<14.8

Apple iPhone OS<12.5.5

Apple iPhone OS>=13.0<14.8

Apple iOS and macOS>=10.15<10.15.7

Apple iOS and macOS=10.15.7

Apple iOS and macOS=10.15.7-security_update_2020

Apple iOS and macOS=10.15.7-security_update_2020-001

Apple iOS and macOS=10.15.7-security_update_2021-001

Apple iOS and macOS=10.15.7-security_update_2021-002

Apple iOS and macOS=10.15.7-security_update_2021-003

Apple iOS and macOS=10.15.7-security_update_2021-004

Apple macOS<11.6

Apple WatchOS<7.6.2

Xpdfreader Xpdf<4.04

Freedesktop poppler<22.09.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apple macOS to a version that resolves this vulnerability.
Fixed in 11.6
Upgrade
Upgrade Apple iOS, iPadOS, and watchOS to a version that resolves this vulnerability.
Fixed in 7.6.2
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 12.5.5
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 14.8
Upgrade
Upgrade Apple iOS, iPadOS, and macOS to a version that resolves this vulnerability.
Fixed in 14.8
Upgrade
Upgrade macOS Catalina to a version that resolves this vulnerability.
Patch Security Update 2021-005 Catalina

Event History

Aug 24, 2021

CVE Published

via MITRE·06:49 PM

Data Sourced

via MITRE·06:49 PM

DescriptionWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Nov 3, 2021

Known Exploited

via CISA·12:00 AM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2021-30860?

CVE-2021-30860 is an integer overflow vulnerability in Apple iOS, iPadOS, macOS, and watchOS CoreGraphics that allows code execution when processing a maliciously crafted PDF.

How can the CVE-2021-30860 vulnerability be exploited?

The CVE-2021-30860 vulnerability can be exploited by processing a specially crafted PDF file.

Which Apple products are affected by CVE-2021-30860?

Apple iOS, iPadOS, macOS, and watchOS are affected by CVE-2021-30860.

What is the severity of CVE-2021-30860?