All vulnerabilities
CVE-2021-30860

Apple Multiple Products Integer Overflow Vulnerability

Apple Multiple Products
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 3 Nov 2021CISA KEV
Exploit odds (EPSS)76.0%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.6Also 2021-005, 7.6 and 1 moreCVE List
Federal deadline17 Nov 2021Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 24 Aug 2021, 18:49 UTCPublishedCVE List
  2. 3 Nov 2021Added to CISA KEVCISA KEV

Description

Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.

Text from CVE List

Affected versions 4

  • macOSaffected: unspecified before 11.6CVE List
  • macOSaffected: unspecified before 2021-005CVE List
  • watchOSaffected: unspecified before 7.6CVE List
  • iOSaffected: unspecified before 14.8CVE List

References 8