Vulnerability Name:

CVE-2021-1883 (CCN-200697)

Assigned:2020-12-08
Published:2021-04-26
Updated:2022-06-28
Summary:This issue was addressed with improved checks. This issue is fixed in Security Update 2021-004 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, Security Update 2021-003 Catalina, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted server messages may lead to heap corruption.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): 
Attack Complexity (AC): 
Privileges Required (PR): 
User Interaction (UI): 
Scope:Scope (S): 
Impact Metrics:Confidentiality (C): 
Integrity (I): 
Availibility (A): 
9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): 
Attack Complexity (AC): 
Privileges Required (PR): 
User Interaction (UI): 
Scope:Scope (S): 
Impact Metrics:Confidentiality (C): 
Integrity (I): 
Availibility (A): 
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-787
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-1883

Source: XF
Type: UNKNOWN
apple-ios-cve20211883-code-exec(200697)

Source: CCN
Type: Apple security document HT212317
About the security content of iOS 14.5 and iPadOS 14.5

Source: MISC
Type: Vendor Advisory
https://support.apple.com/en-us/HT212317

Source: MISC
Type: Vendor Advisory
https://support.apple.com/en-us/HT212323

Source: MISC
Type: Vendor Advisory
https://support.apple.com/en-us/HT212324

Source: MISC
Type: Vendor Advisory
https://support.apple.com/en-us/HT212325

Source: CCN
Type: Apple security document HT212530
About the security content of Security Update 2021-003 Catalina

Source: MISC
Type: Vendor Advisory
https://support.apple.com/en-us/HT212530

Source: CCN
Type: Apple security document HT212531
About the security content of Security Update 2021-004 Mojave

Source: MISC
Type: Vendor Advisory
https://support.apple.com/en-us/HT212531

Vulnerable Configuration:Configuration 1:
  • cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2021-002:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.6:-:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.6:supplemental_update:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*
  • OR cpe:/o:apple:macos:*:*:*:*:*:*:*:* (Version >= 11.0 and < 11.3)
  • OR cpe:/o:apple:ipados:*:*:*:*:*:*:*:* (Version < 14.5)
  • OR cpe:/o:apple:iphone_os:*:*:*:*:*:*:*:* (Version < 14.5)
  • OR cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:* (Version >= 10.14 and <= 10.14.5)
  • OR cpe:/o:apple:mac_os_x:10.14.6:security_update_2021-003:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:* (Version >= 10.15 and <= 10.15.5)
  • OR cpe:/o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
  • OR cpe:/o:apple:tvos:*:*:*:*:*:*:*:* (Version < 14.5)
  • OR cpe:/o:apple:watchos:*:*:*:*:*:*:*:* (Version < 7.4)

    • Configuration CCN 1:
  • cpe:/o:apple:ios:14.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:ipados:14.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Vulnerability Name:

    CVE-2021-1883 (CCN-202293)

    Assigned:2020-12-08
    Published:2021-05-24
    Updated:2021-05-24
    Summary:Apple macOS Catalina could allow a remote attacker to execute arbitrary code on the system, caused by an error in the Heimdal component. By sending specially crafted server messages, an attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.
    CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
    4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): 
    Attack Complexity (AC): 
    Privileges Required (PR): 
    User Interaction (UI): 
    Scope:Scope (S): 
    Impact Metrics:Confidentiality (C): 
    Integrity (I): 
    Availibility (A): 
    9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
    8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): 
    Attack Complexity (AC): 
    Privileges Required (PR): 
    User Interaction (UI): 
    Scope:Scope (S): 
    Impact Metrics:Confidentiality (C): 
    Integrity (I): 
    Availibility (A): 
    CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Medium
    Authentication (Au): None
    Impact Metrics:Confidentiality (C): None
    Integrity (I): Partial
    Availibility (A): None
    10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Low
    Athentication (Au): None
    Impact Metrics:Confidentiality (C): Complete
    Integrity (I): Complete
    Availibility (A): Complete
    Vulnerability Consequences:Gain Access
    References:Source: MITRE
    Type: CNA
    CVE-2021-1883

    Source: XF
    Type: UNKNOWN
    apple-macos-cve20211883-code-exec(202293)

    Source: CCN
    Type: Apple security document HT212530
    About the security content of Security Update 2021-003 Catalina

    Vulnerable Configuration:Configuration CCN 1:
  • cpe:/o:apple:macos_catalina:10.15.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    apple mac os x 10.14.6 security_update_2020-001
    apple mac os x 10.14.6 security_update_2020-002
    apple mac os x 10.14.6 security_update_2020-003
    apple mac os x 10.14.6 security_update_2020-004
    apple mac os x 10.14.6 security_update_2020-005
    apple mac os x 10.14.6 security_update_2020-006
    apple mac os x 10.14.6 security_update_2019-007
    apple mac os x 10.14.6 security_update_2019-004
    apple mac os x 10.14.6 security_update_2019-005
    apple mac os x 10.14.6 -
    apple mac os x 10.14.6 security_update_2019-001
    apple mac os x 10.14.6 security_update_2019-002
    apple mac os x 10.14.6 security_update_2019-006
    apple mac os x 10.14.6 security_update_2020-007
    apple mac os x 10.14.6 security_update_2021-001
    apple mac os x 10.14.6 security_update_2021-002
    apple mac os x 10.14.6 supplemental_update
    apple mac os x 10.14.6 supplemental_update_2
    apple mac os x 10.15.6 -
    apple mac os x 10.15.6 supplemental_update
    apple mac os x 10.15.7 -
    apple mac os x 10.15.7 security_update_2020
    apple mac os x 10.15.7 security_update_2020-001
    apple mac os x 10.15.7 security_update_2020-005
    apple mac os x 10.15.7 security_update_2020-007
    apple mac os x 10.15.7 supplemental_update
    apple macos *
    apple ipados *
    apple iphone os *
    apple mac os x *
    apple mac os x 10.14.6 security_update_2021-003
    apple mac os x *
    apple mac os x 10.15.7 security_update_2021-001
    apple mac os x 10.15.7 security_update_2021-002
    apple tvos *
    apple watchos *
    apple ios 14.4
    apple ipados 14.4
    apple macos catalina 10.15.2