Actively exploited in the wild
Apple Multiple Products Type Confusion Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2022-05-04. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-1789
HighCVSS 8.8KEVSummary
A type confusion issue exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS, Safari) due to improper state handling. Processing maliciously crafted web content may lead to arbitrary code execution.
Risk Assessment
A remote attacker could execute arbitrary code in the context of the browser or application, potentially leading to full device compromise.
Recommendation
Update Apple systems to macOS Big Sur 11.2, Security Update 2021-001 Catalina/Mojave, iOS/iPadOS 14.4, watchOS 7.3, tvOS 14.4, Safari 14.0.3.
Other vulnerabilities in Apple WebKit
See all- CVE-2023-32435HighActively exploited
A memory corruption issue was addressed with improved state management. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
- CVE-2023-32409HighActively exploited
The issue was addressed with improved bounds checks. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2023-32373HighActively exploited
A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Original NVD description (English source)
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.