Xingwei Lin

The issue is related to incorrect clearing or release of resources, which may lead to an unexpected app termination when parsing a file. Exploitation of this issue may allow an attacker to cause a denial of service.

The issue is related to an out-of-bounds write vulnerability that may allow an attacker to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited. The estimated number of potentially affected devices is not specified.

The issue was addressed with improved memory handling. Processing a maliciously crafted USD file may disclose memory contents.

The issue is related to an out-of-bounds read in the ImageIO component, which can be exploited by processing a maliciously crafted tiff file. This may lead to a denial-of-service or potentially disclose memory contents, allowing an attacker to gain unauthorized access to protected information.

The issue is related to an out-of-bounds read in the FontParser component, which can result in the disclosure of process memory when processing a maliciously crafted font. This can allow a remote attacker to reveal protected information.

The issue is related to the FontParser component in Apple operating systems, which is vulnerable to a buffer overflow in memory. This can be exploited by processing a maliciously crafted dfont file, potentially leading to arbitrary code execution.

Processing a maliciously crafted dfont file may lead to arbitrary code execution. This issue was addressed with improved checks.

This issue was addressed with improved checks. Processing a maliciously crafted dfont file may lead to arbitrary code execution.

The issue was addressed with improved checks. Processing a maliciously crafted dfont file may lead to arbitrary code execution.

An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted USD file may disclose memory contents.

An out-of-bounds read issue was addressed with improved bounds checking. Processing a maliciously crafted USD file may disclose memory contents.

A buffer overflow issue was addressed with improved memory handling. Processing a maliciously crafted USD file may disclose memory contents.

A buffer overflow issue was addressed with improved memory handling. Processing a maliciously crafted USD file may disclose memory contents.

The issue is related to the processing of maliciously crafted fonts, which may result in the disclosure of process memory due to an out-of-bounds read. This can potentially allow an attacker to access protected information. The problem was addressed with improved input validation.

Processing a maliciously crafted font may result in the disclosure of process memory. An out-of-bounds read was addressed with improved input validation.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.3 watchOS versions prior to 7.4 Description: The issue allows arbitrary code execution when processing a maliciously crafted image. Recommendations: For macOS versions prior to 11.3, update to macOS Big Sur 11.3 to resolve the issue. For watchOS versions prior to 7.4, update to watchOS 7.4 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: iTunes versions prior to 12.11.3 for Windows Security Update versions prior to 2021-002 for Catalina Security Update versions prior to 2021-003 for Mojave iCloud for Windows versions prior to 12.3 macOS Big Sur versions prior to 11.3 watchOS versions prior to 7.4 tvOS versions prior to 14.5 iOS versions prior to 14.5 iPadOS versions prior to 14.5 Description: A logic issue was addressed with improved state management. Processing a maliciously crafted font may result in the disclosure of process memory. Recommendations: For iTunes versions prior to 12.11.3 for Windows, update to version 12.11.3 or later. For Security Update versions prior to 2021-002 for Catalina, apply Security Update 2021-002 or later. For Security Update versions prior to 2021-003 for Mojave, apply Security Update 2021-003 or later. For iCloud for Windows versions prior to 12.3, update to version 12.3 or later. For macOS Big Sur versions prior to 11.3, update to version 11.3 or later. For watchOS versions prior to 7.4, update to version 7.4 or later. For tvOS versions prior to 14.5, update to version 14.5 or later. For iOS versions prior to 14.5, update to version 14.5 or later. For iPadOS versions prior to 14.5, update to version 14.5 or later.

Processing a maliciously crafted image may lead to arbitrary code execution. The issue was addressed with improved checks.

Name of the Vulnerable Software and Affected Versions: macOS Big Sur versions prior to 11.3 watchOS versions prior to 7.4 Description: The issue allows arbitrary code execution when processing a maliciously crafted image. This is due to insufficient checks that have been improved in the fixed versions. Recommendations: For macOS Big Sur versions prior to 11.3, update to macOS Big Sur 11.3 to resolve the issue. For watchOS versions prior to 7.4, update to watchOS 7.4 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.3 iOS versions prior to 14.5 iPadOS versions prior to 14.5 watchOS versions prior to 7.4 tvOS versions prior to 14.5 Description: An out-of-bounds read issue was addressed with improved input validation. Processing a maliciously crafted font file may lead to arbitrary code execution. Recommendations: For macOS versions prior to 11.3, update to macOS Big Sur 11.3 or later. For iOS versions prior to 14.5, update to iOS 14.5 or later. For iPadOS versions prior to 14.5, update to iPadOS 14.5 or later. For watchOS versions prior to 7.4, update to watchOS 7.4 or later. For tvOS versions prior to 14.5, update to tvOS 14.5 or later. As a temporary workaround, consider avoiding the use of maliciously crafted font files until a patch is available.