CVE-2021-1811: A logic issue was addressed with improved state management

Description

A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.11.3 for Windows, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iCloud for Windows 12.3, macOS Big Sur 11.3, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing a maliciously crafted font may result in the disclosure of process memory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.7% · higher than 77% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

IO

iOS · Apple

before 14.5 · source: NVD

MA

macOS · Apple

11.0 before 11.3 · source: NVD

IC

Icloud · Apple

before 12.3 · source: NVD

IT

Itunes · Apple

before 12.11.3 · source: NVD

MO

Mac OS X · Apple

10.14 through 10.14.5; 10.15 through 10.15.5; 10.14.6; 10.14.6; 10.14.6; 10.14.6; +23 more · source: NVD

TV

Tvos · Apple

before 14.5 · source: NVD

WA

Watchos · Apple

before 7.4 · source: NVD