Vulnerability Name: CVE-2021-1778 (CCN-195902) Assigned: 2020-12-08 Published: 2021-02-01 Updated: 2021-04-09 Summary: An out-of-bounds read issue existed in the curl. This issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to a denial of service. CVSS v3 Severity: 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H )4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): RequiredScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): High
5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H )4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): RequiredScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): High
CVSS v2 Severity: 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P )Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAuthentication (Au): NoneImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAthentication (Au): Single_InstanceImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): Complete
Vulnerability Type: CWE-125 Vulnerability Consequences: Denial of Service References: Source: MITRE Type: CNACVE-2021-1778 Source: XF Type: UNKNOWNapple-macos-cve20211778-dos(195902) Source: MISC Type: Release Notes, Vendor Advisoryhttps://support.apple.com/en-us/HT212146 Source: CCN Type: Apple security document HT212147About the security content of macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave Source: MISC Type: Release Notes, Vendor Advisoryhttps://support.apple.com/en-us/HT212147 Source: MISC Type: Release Notes, Vendor Advisoryhttps://support.apple.com/en-us/HT212148 Source: MISC Type: Release Notes, Vendor Advisoryhttps://support.apple.com/en-us/HT212149 Vulnerable Configuration: Configuration 1 :cpe:/o:apple:ipados:*:*:*:*:*:*:*:* (Version < 14.4)OR cpe:/o:apple:iphone_os:*:*:*:*:*:*:*:* (Version < 14.4) OR cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:* (Version >= 10.14 and < 10.14.6) OR cpe:/o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:* (Version >= 10.15 and < 10.15.7) OR cpe:/o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:* OR cpe:/o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:* OR cpe:/o:apple:macos:*:*:*:*:*:*:*:* (Version >= 11.0 and < 11.2) OR cpe:/o:apple:tvos:*:*:*:*:*:*:*:* (Version < 14.4) OR cpe:/o:apple:watchos:*:*:*:*:*:*:*:* (Version < 7.3) Configuration CCN 1 :cpe:/o:apple:macos_catalina:10.15.6:*:*:*:*:*:*:* OR cpe:/o:apple:macos_big_sur:11.0.0:*:*:*:*:*:*:* Denotes that component is vulnerable BACK
apple ipados *
apple iphone os *
apple mac os x *
apple mac os x 10.14.6 -
apple mac os x 10.14.6 security_update_2019-004
apple mac os x 10.14.6 security_update_2019-005
apple mac os x 10.14.6 security_update_2019-006
apple mac os x 10.14.6 security_update_2019-007
apple mac os x 10.14.6 security_update_2020-001
apple mac os x 10.14.6 security_update_2020-002
apple mac os x 10.14.6 security_update_2020-003
apple mac os x 10.14.6 security_update_2020-004
apple mac os x 10.14.6 security_update_2020-005
apple mac os x 10.14.6 security_update_2020-006
apple mac os x 10.14.6 security_update_2020-007
apple mac os x 10.14.6 supplemental_update
apple mac os x 10.14.6 supplemental_update_2
apple mac os x *
apple mac os x 10.15.7 -
apple mac os x 10.15.7 supplemental_update
apple macos *
apple tvos *
apple watchos *
apple macos catalina 10.15.6
apple macos big sur 11.0.0