First published: Mon Apr 26 2021(Updated: )
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing a maliciously crafted font file may lead to arbitrary code execution.
Credit: an anonymous researcher Xingwei Lin Ant Security LightMickey Jin Trend Micro Hou JingYi @hjy79425575 Qihoo 360an anonymous researcher Xingwei Lin Ant Security LightMickey Jin Trend Micro Hou JingYi @hjy79425575 Qihoo 360an anonymous researcher Ant Security LightXingwei Lin Ant Security LightMickey Jin Trend Micro Qihoo 360Hou JingYi @hjy79425575 Qihoo 360an anonymous researcher Xingwei Lin Ant Security LightMickey Jin Trend Micro Hou JingYi @hjy79425575 Qihoo 360Hou JingYi @hjy79425575 Qihoo 360an anonymous researcher Xingwei Lin Ant Security Light Mickey Jin Trend MicroHou JingYi @hjy79425575 Qihoo 360an anonymous researcher Xingwei Lin Ant Security Light Mickey Jin Trend Micro product-security@apple.com
Affected Software | Affected Version | How to fix |
---|---|---|
Apple iOS | <14.5 | 14.5 |
Apple iPadOS | <14.5 | 14.5 |
Apple tvOS | <14.5 | 14.5 |
<7.4 | 7.4 | |
Apple macOS Big Sur | <11.3 | 11.3 |
Apple Catalina | ||
Apple Mojave | ||
Apple iPadOS | <14.5 | |
Apple iPhone OS | <14.5 | |
Apple Mac OS X | >=10.14<=10.14.5 | |
Apple Mac OS X | >=10.15<=10.15.5 | |
Apple Mac OS X | =10.14.6 | |
Apple Mac OS X | =10.14.6-security_update_2019-001 | |
Apple Mac OS X | =10.14.6-security_update_2019-002 | |
Apple Mac OS X | =10.14.6-security_update_2019-004 | |
Apple Mac OS X | =10.14.6-security_update_2019-005 | |
Apple Mac OS X | =10.14.6-security_update_2019-006 | |
Apple Mac OS X | =10.14.6-security_update_2019-007 | |
Apple Mac OS X | =10.14.6-security_update_2020-001 | |
Apple Mac OS X | =10.14.6-security_update_2020-002 | |
Apple Mac OS X | =10.14.6-security_update_2020-003 | |
Apple Mac OS X | =10.14.6-security_update_2020-004 | |
Apple Mac OS X | =10.14.6-security_update_2020-005 | |
Apple Mac OS X | =10.14.6-security_update_2020-006 | |
Apple Mac OS X | =10.14.6-security_update_2020-007 | |
Apple Mac OS X | =10.14.6-security_update_2021-001 | |
Apple Mac OS X | =10.14.6-security_update_2021-002 | |
Apple Mac OS X | =10.14.6-supplemental_update | |
Apple Mac OS X | =10.14.6-supplemental_update_2 | |
Apple Mac OS X | =10.15.6 | |
Apple Mac OS X | =10.15.6-supplemental_update | |
Apple Mac OS X | =10.15.7 | |
Apple Mac OS X | =10.15.7-security_update_2020 | |
Apple Mac OS X | =10.15.7-security_update_2020-001 | |
Apple Mac OS X | =10.15.7-security_update_2020-005 | |
Apple Mac OS X | =10.15.7-security_update_2020-007 | |
Apple Mac OS X | =10.15.7-security_update_2021-001 | |
Apple Mac OS X | =10.15.7-supplemental_update | |
Apple macOS | >=11.0<11.3 | |
Apple tvOS | <14.5 | |
Apple watchOS | <7.4 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
CVE-2021-1881 is a vulnerability in Apple's FontParser that allows an attacker to read out-of-bounds memory due to inadequate input validation.
The severity of CVE-2021-1881 is not mentioned in the provided information.
Affected software versions include Apple iOS up to version 14.5, Apple iPadOS up to version 14.5, Apple watchOS up to version 7.4, Apple macOS Big Sur up to version 11.3, Apple Catalina, Apple tvOS up to version 14.5, and Apple Mojave.
To fix CVE-2021-1881, apply the recommended updates provided by Apple for the affected software versions.
You can find more information about CVE-2021-1881 on Apple's official support page with the reference links: [https://support.apple.com/en-us/HT212326](https://support.apple.com/en-us/HT212326), [https://support.apple.com/en-us/HT212327](https://support.apple.com/en-us/HT212327), and [https://support.apple.com/en-us/HT212317](https://support.apple.com/en-us/HT212317).