Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · December 2021 — Apple Security Advisories
28 advisories 28 CVEs 1 EXPLOITED

Apple-vendor CVEs for 2021-12. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild — see the Exploited section.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2021-44228

OtherExploitedCISA KEV listedCRITICAL2021-12-09

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attack...

CVEs:CVE-2021-44228

Affected products

ProductStatusVendorPackageEcosystem
xcode affected apple — —
Upstream advisory

CVE-2021-44790

OtherWeaponized exploitCRITICAL2021-12-19

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This i...

CVEs:CVE-2021-44790

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2021-44224

OtherPoC exploitHIGH2021-12-19

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Dom...

CVEs:CVE-2021-44224

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2021-4136

OtherPoC exploitCRITICAL2021-12-19

vim is vulnerable to Heap-based Buffer Overflow

CVEs:CVE-2021-4136

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2021-4193

OtherPoC exploitMEDIUM2021-12-31

vim is vulnerable to Out-of-bounds Read

CVEs:CVE-2021-4193

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2021-4192

OtherPoC exploitCRITICAL2021-12-31

vim is vulnerable to Use After Free

CVEs:CVE-2021-4192

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2021-4187

OtherPoC exploitCRITICAL2021-12-29

vim is vulnerable to Use After Free

CVEs:CVE-2021-4187

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2021-4173

OtherPoC exploitCRITICAL2021-12-27

vim is vulnerable to Use After Free

CVEs:CVE-2021-4173

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2021-4166

OtherPoC exploitHIGH2021-12-25

vim is vulnerable to Out-of-bounds Read

CVEs:CVE-2021-4166

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2021-30767

iPadOSPoC exploitMEDIUM2021-12-13

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, watchOS 8.3. A local user may be able to modify protected parts o...

CVEs:CVE-2021-30767

Affected products

ProductStatusVendorPackageEcosystem
ipados affected apple — —
iphone_os affected apple — —
macos affected apple — —
mac_os_x affected apple — —
watchos affected apple — —
Upstream advisory

CVE-2019-8703

watchOSEPSS <= 49%CRITICAL2021-12-23

This issue was addressed with improved entitlements. This issue is fixed in watchOS 6, tvOS 13, macOS Catalina 10.15, iOS 13. An application may be able to gain elevated privileges.

CVEs:CVE-2019-8703

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
mac_os_x affected apple — —
tvos affected apple — —
watchos affected apple — —
Upstream advisory

CVE-2019-8643

macOSEPSS <= 49%CRITICAL2021-12-23

CVE-2019-8643: Arun Sharma of VMWare This issue is fixed in macOS Mojave 10.14. Description: A logic issue was addressed with improved state management..

CVEs:CVE-2019-8643

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2020-3886

macOSEPSS <= 49%HIGH2021-12-23

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra. A malicious application may be able to execute arbitrary code wi...

CVEs:CVE-2020-3886

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2017-13892

macOSEPSS <= 49%HIGH2021-12-23

An issue existed in the handling of Contact sharing. This issue was addressed with improved handling of user information. This issue is fixed in macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan. Sharin...

CVEs:CVE-2017-13892

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2018-4302

watchOSEPSS <= 49%CRITICAL2021-12-23

A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13, iCloud for Windows 7.0, watchOS 4, iOS 11, iTunes 12.7 for Windows. Processing maliciously crafted XML may lead to an unexpected applicat...

CVEs:CVE-2018-4302

Affected products

ProductStatusVendorPackageEcosystem
icloud affected apple — —
iphone_os affected apple — —
itunes affected apple — —
mac_os_x affected apple — —
watchos affected apple — —
Upstream advisory

CVE-2017-13905

watchOSEPSS <= 49%HIGH2021-12-23

A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, watchOS 4.2. An application may be able to gain ...

CVEs:CVE-2017-13905

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
macos affected apple — —
mac_os_x affected apple — —
tvos affected apple — —
watchos affected apple — —
Upstream advisory

CVE-2017-13880

watchOSEPSS <= 49%HIGH2021-12-23

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 11.2, watchOS 4.2. An application may be able to execute arbitrary code with kernel privilege.

CVEs:CVE-2017-13880

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
watchos affected apple — —
Upstream advisory

CVE-2017-13835

macOSEPSS <= 49%CRITICAL2021-12-23

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS High Sierra 10.13. An application may be able to execute arbitrary code with elevated privileges.

CVEs:CVE-2017-13835

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2017-13906

macOSEPSS <= 49%CRITICAL2021-12-23

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, macOS High Sierra 10.13. A malicious application may be a...

CVEs:CVE-2017-13906

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2017-2488

OtherEPSS <= 49%HIGH2021-12-23

A cryptographic weakness existed in the authentication protocol of Remote Desktop. This issue was addressed by implementing the Secure Remote Password authentication protocol. This issue is fixed in Apple Remote Desktop 3.9. An attacker may be able to ...

CVEs:CVE-2017-2488

Affected products

ProductStatusVendorPackageEcosystem
remote_desktop affected apple — —
Upstream advisory

CVE-2020-3896

macOSEPSS <= 49%HIGH2021-12-23

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra. A malicious application may be able to overwrite arbitrary files.

CVEs:CVE-2020-3896

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2018-4478

macOSEPSS <= 49%HIGH2021-12-23

A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan. An attacker with physical access to a device may be able to elevate privileges.

CVEs:CVE-2018-4478

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2017-13907

macOSEPSS <= 49%MEDIUM2021-12-23

A state management issue was addressed with improved state validation. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan. The screen lock may unexpectedly remain unlocked.

CVEs:CVE-2017-13907

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2019-8702

tvOSEPSS <= 49%MEDIUM2021-12-23

This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra, iOS 12.4, tvOS 12.4. A local user may be able to read a persistent account identifier.

CVEs:CVE-2019-8702

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
mac_os_x affected apple — —
tvos affected apple — —
Upstream advisory

CVE-2017-13910

macOSEPSS <= 49%MEDIUM2021-12-23

An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files.

CVEs:CVE-2017-13910

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2017-13908

macOSEPSS <= 49%HIGH2021-12-23

An issue in handling file permissions was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, macOS High Sierra 10.13. A local attacker may be a...

CVEs:CVE-2017-13908

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2017-13909

macOSEPSS <= 49%MEDIUM2021-12-23

An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain. This issue is fixed in macOS High Sierra 10.13. A local attacker may gain access to iCloud authentication tokens.

CVEs:CVE-2017-13909

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2017-2375

iOSEPSS <= 49%LOW2021-12-23

An issue existed in preventing the uploading of CallKit call history to iCloud. This issue was addressed through improved logic. This issue is fixed in iOS 10.2.1. Updates for CallKit call history are sent to iCloud.

CVEs:CVE-2017-2375

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console