Sign-up

ID

VAR-202104-0640


CVE

CVE-2021-1775


TITLE

Apple macOS libFontParser TTF Parsing Integer Underflow Information Disclosure Vulnerability

Trust: 0.7

sources: ZDI: ZDI-21-138

DESCRIPTION

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Processing a maliciously crafted font may lead to arbitrary code execution. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the libFontParser library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.The specific flaw exists within the parsing of TTF fonts. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before reading from memory. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Apple macOS is a set of dedicated operating systems developed by Apple Corporation for Mac computers. There is a security vulnerability in Apple macOS. The vulnerability stems from insufficient validation of the input provided by the user when the font file is processed in the FontParser component of macOS, so this vulnerability exists. A remote attacker could trick a victim into opening a specially crafted document or web page and execute arbitrary code on the system. Vulnerabilities exist in the following products or versions: macOS 10.14, macOS 10.14.1, macOS 10.14.2, macOS 10.14.3, macOS 10.14.4, macOS 10.14.5, macOS 10.14.6

Trust: 1.71

sources: NVD: CVE-2021-1775 // ZDI: ZDI-21-138 // VULHUB: VHN-376435 // VULMON: CVE-2021-1775

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:gteversion:10.15

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.15.7

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.14.6

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.2

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.15.7

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.14.6

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.14

Trust: 1.0

vendor:applemodel:macosscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-21-138 // NVD: CVE-2021-1775

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1775
value: HIGH

Trust: 1.0

ZDI: CVE-2021-1775
value: LOW

Trust: 0.7

CNNVD: CNNVD-202102-089
value: HIGH

Trust: 0.6

VULHUB: VHN-376435
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-1775
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-376435
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1775
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2021-1775
baseSeverity: LOW
baseScore: 3.3
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 1.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-138 // VULHUB: VHN-376435 // CNNVD: CNNVD-202102-089 // NVD: CVE-2021-1775

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2021-1775

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202102-089

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202102-089

PATCH

title:Apple has issued an update to correct this vulnerability.url:https://support.apple.com/en-us/HT212147

Trust: 0.7

title:Apple macOS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=140301

Trust: 0.6

sources: ZDI: ZDI-21-138 // CNNVD: CNNVD-202102-089

EXTERNAL IDS

db:NVDid:CVE-2021-1775

Trust: 2.5

db:ZDI_CANid:ZDI-CAN-11876

Trust: 0.7

db:ZDIid:ZDI-21-138

Trust: 0.7

db:AUSCERTid:ESB-2021.0349

Trust: 0.6

db:CNNVDid:CNNVD-202102-089

Trust: 0.6

db:VULHUBid:VHN-376435

Trust: 0.1

db:VULMONid:CVE-2021-1775

Trust: 0.1

sources: ZDI: ZDI-21-138 // VULHUB: VHN-376435 // VULMON: CVE-2021-1775 // CNNVD: CNNVD-202102-089 // NVD: CVE-2021-1775

REFERENCES

url:https://support.apple.com/en-us/ht212147

Trust: 2.4

url:https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-34452

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1775

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.0349/

Trust: 0.6

url:https://support.apple.com/en-us/ht211931

Trust: 0.6

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/195908

Trust: 0.1

url:http://seclists.org/fulldisclosure/2021/feb/14

Trust: 0.1

sources: ZDI: ZDI-21-138 // VULHUB: VHN-376435 // VULMON: CVE-2021-1775 // CNNVD: CNNVD-202102-089 // NVD: CVE-2021-1775

CREDITS

Mickey Jin & Qi Sun of Trend Micro Mobile Security Research Team

Trust: 0.7

sources: ZDI: ZDI-21-138

SOURCES

db:ZDIid:ZDI-21-138
db:VULHUBid:VHN-376435
db:VULMONid:CVE-2021-1775
db:CNNVDid:CNNVD-202102-089
db:NVDid:CVE-2021-1775

LAST UPDATE DATE

2024-11-23T20:53:19.260000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-21-138date:2021-02-04T00:00:00
db:VULHUBid:VHN-376435date:2021-04-09T00:00:00
db:VULMONid:CVE-2021-1775date:2021-04-09T00:00:00
db:CNNVDid:CNNVD-202102-089date:2021-10-29T00:00:00
db:NVDid:CVE-2021-1775date:2024-11-21T05:45:05.200

SOURCES RELEASE DATE

db:ZDIid:ZDI-21-138date:2021-02-04T00:00:00
db:VULHUBid:VHN-376435date:2021-04-02T00:00:00
db:VULMONid:CVE-2021-1775date:2021-04-02T00:00:00
db:CNNVDid:CNNVD-202102-089date:2021-02-02T00:00:00
db:NVDid:CVE-2021-1775date:2021-04-02T18:15:20.920