Vulnerability Details : CVE-2021-30665
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
Vulnerability category: Memory Corruption
Products affected by CVE-2021-30665
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
CVE-2021-30665 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Apple Multiple Products WebKit Memory Corruption Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products wh
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2021-30665
Added on
2021-11-03
Action due date
2021-11-17
Exploit prediction scoring system (EPSS) score for CVE-2021-30665
0.56%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 67 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-30665
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-01-29 |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2021-30665
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2021-30665
-
https://support.apple.com/en-us/HT212532
About the security content of tvOS 14.6 - Apple SupportRelease Notes;Vendor Advisory
-
https://support.apple.com/en-us/HT212339
About the security content of watchOS 7.4.1 - Apple SupportRelease Notes;Vendor Advisory
-
https://support.apple.com/en-us/HT212336
About the security content of iOS 14.5.1 and iPadOS 14.5.1 - Apple SupportRelease Notes;Vendor Advisory
-
https://support.apple.com/en-us/HT212335
About the security content of macOS Big Sur 11.3.1 - Apple SupportRelease Notes;Vendor Advisory
-
https://support.apple.com/en-us/HT212341
About the security content of iOS 12.5.3 - Apple SupportRelease Notes;Vendor Advisory
Jump to