Tim Michaud

A use-after-free issue exists where an application may cause unexpected system termination or corrupt kernel memory. Use-after-free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A use-after-free issue, which occurs when a program continues to use a pointer after it has been freed, can lead to unexpected system termination or corruption of kernel memory. This was addressed through improved memory management.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.

A security issue has been identified, and Apple Product Security has been notified. The company is expected to update its advisories. No details are provided about the nature of the issue or its potential impact.

An out-of-bounds read issue was addressed with improved input validation, which may allow an app to disclose kernel memory.

An injection issue was addressed with improved input validation, which may allow an app to gain root privileges.

A memory corruption issue was addressed with improved state management, which may allow an app to execute arbitrary code with kernel privileges.

The issue was addressed with improved bounds checks, which suggests it involved a buffer overflow or similar issue where data was written outside the intended boundaries. An app with root privileges may be able to execute arbitrary code with kernel privileges, indicating a potential for privilege escalation.

A memory corruption issue was addressed with improved memory handling. This issue allows a malicious application to execute arbitrary code with kernel privileges.

An injection issue was addressed with improved validation, which may allow a malicious application to gain root privileges.

An out-of-bounds write issue was addressed with improved bounds checking. A malicious application may be able to gain root privileges.

An application may be able to execute arbitrary code with system privileges. The issue was addressed with improved permissions logic.

Name of the Vulnerable Software and Affected Versions: macOS Big Sur versions prior to 11.3 Description: A logic issue was addressed with improved state management, which may allow a local attacker to elevate their privileges. Recommendations: For versions prior to 11.3, update to macOS Big Sur 11.3 to resolve the issue.

A logic issue was addressed with improved state management, which may allow a local attacker to elevate their privileges. The issue is related to insufficient access control in the Tailspin component of the affected operating systems.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.3 Security Update versions prior to 2021-002 Catalina Security Update versions prior to 2021-003 Mojave Description: The issue was addressed with improved permissions logic. A local attacker may be able to elevate their privileges. Recommendations: For macOS versions prior to 11.3, update to macOS Big Sur 11.3. For Security Update versions prior to 2021-002 Catalina, apply Security Update 2021-002 Catalina. For Security Update versions prior to 2021-003 Mojave, apply Security Update 2021-003 Mojave.

A logic issue was addressed with improved state management, which may allow a malicious application to elevate privileges.

An issue existed within the path validation logic for symlinks, which was addressed with improved path sanitization. A local attacker may be able to elevate their privileges.

The issue existed within the path validation logic for symlinks, which was addressed with improved path sanitization. A local attacker may be able to elevate their privileges.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.1 macOS Mojave versions prior to 10.14.1 tvOS versions prior to 12.1 watchOS versions prior to 5.1 Description: An out-of-bounds read issue was addressed through improved input validation. Recommendations: For iOS versions prior to 12.1, update to iOS 12.1 or later. For macOS Mojave versions prior to 10.14.1, update to macOS Mojave 10.14.1 or later. For tvOS versions prior to 12.1, update to tvOS 12.1 or later. For watchOS versions prior to 5.1, update to watchOS 5.1 or later.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.