Apple hat zwei Schwachstellen in Safari respektive in der dem Browser zugrundeliegenden HTML-Render-Engine WebKit, einer weiterentwickelten Abspaltung von KHTML und der JavaScript-Implementierung KJS, behoben und dazu Updates für iOS und iPadOS sowie macOS und watchOS veröffentlicht.
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A memory corruption issue was addressed with improved state management.
CVE-2021-30665: yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA
WebKit
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: An integer overflow was addressed with improved input validation.
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A memory corruption issue was addressed with improved state management.
CVE-2021-30665: yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A memory corruption issue was addressed with improved state management.
CVE-2021-30665: yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA
WebKit
Available for: macOS Big Sur
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: An integer overflow was addressed with improved input validation.
CVE-2021-30663: an anonymous researcher
Die Sicherheitslücke besteht aufgrund eines Begrenzungsfehlers („Boundary Error“) in WebKit. Ein entfernter Angreifer kann über eine entsprechend manipulierte Website einen beliebigen schadhaften Code auf dem Zielsystem des Opfers auszuführen.
Die Sicherheitslücke wurde bereits aktiv in freier Wildbahn ausgenutzt und wird erst mit der Installation der entsprechenden Updates geschlossen. Auf einem iPhone 12 ist das Update auf iOS 14.5.1 rund 130 MB groß.
Die Redaktion dankt Community-Mitglied „Vigilant“ für den Hinweis zu dieser Meldung.
Update
Auch Catalina und Mojave erhalten Update
In der Zwischenzeit hat Apple auch ein entsprechedes Update für macOS Catalina und Mojave sowie Safari 14.1 veröffentlicht und damit die beiden Sicherheitslücken geschlossen. Weitere Inforamtionen liefern die offiziellen Release Notes.
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A memory corruption issue was addressed with improved state management.
CVE-2021-30665: yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA
WebKit
Available for: macOS Catalina and macOS Mojave
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: An integer overflow was addressed with improved input validation.
CVE-2021-30663: an anonymous researcher
Update
iOS 12.5.3 schließt Sicherheitslücken in WebKit
Auch ältere Geräte wie das iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, und der iPod touch der 6. Generation haben mit iOS 12.5.3 ein Update erhalten, welches die beiden Sicherheitslücken in WebKit schließt.
Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2021-30666: yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA
WebKit
Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A memory corruption issue was addressed with improved state management.
CVE-2021-30665: yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA
WebKit
Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: An integer overflow was addressed with improved input validation.
CVE-2021-30663: an anonymous researcher
WebKit Storage
Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A use after free issue was addressed with improved memory management.
CVE-2021-30661: yangkang (@dnpushme)&zerokeeper&bianliang of 360 ATA
Weitere Informationen liefern die offiziellen Release Notes zu iOS 12.5.3.
Die Redaktion dankt Community-Mitglied „iwwazwersch“ für den Hinweis zu diesem Update.
