high7.5Known exploited
CVE-2021-31010
Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-08-25. Federal due date: 2022-09-15.
Apply updates per vendor instructions.
Impact
A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Ipados | before 14.8 |
| Apple | Iphone Os | from 12.0 before 12.5.5 from 14.0 before 14.8 |
| Apple | Mac Os X | from 10.15 before 10.15.7 Version 10.15.7 |
| Apple | Macos | from 11.0 before 11.6 |
| Apple | Watchos | before 7.6.2 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://support.apple.com/en-us/HT212804
- https://support.apple.com/en-us/HT212805
- https://support.apple.com/en-us/HT212806
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212824
- https://support.apple.com/en-us/HT212804
- https://support.apple.com/en-us/HT212805
- https://support.apple.com/en-us/HT212806
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212824
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010