CVE-2021-33909

kernel: size_t-to-int conversion vulnerability in the filesystem layer

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

CVSS 3.1 · 7.8 High EPSS 9.8% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 4 more

Products

Debian Linux Fedora Linux Kernel and 13 more

CVE-2021-32399

kernel: race condition for removal of the HCI controller

net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel Cloud Backup and 24 more

CVE-2021-30984

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 7 more

CVE-2021-30954

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 7 more

CVE-2021-30953

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 7 more

CVE-2021-30951

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 7 more

CVE-2021-30936

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 7 more

CVE-2021-30934

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 7 more

CVE-2021-30897

webkitgtk: Cross-origin data exfiltration via resource timing API

An issue existed in the specification for the resource timing API. The specification was updated and the updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website may exfiltrate data cross-origin.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 3 more

CVE-2021-30890

webkitgtk: Logic issue leading to universal cross-site scripting

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to universal cross site scripting.

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 6 more

CVE-2021-30889

webkitgtk: Buffer overflow leading to arbitrary code execution

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 4 more

CVE-2021-30888

webkitgtk: Information leak via Content Security Policy reports

An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content Security Policy reports may be able to leak information via redirect behavior .

CVSS 3.1 · 7.4 High EPSS 1.7% KEV · Not listed

Vendors

Apple Redhat

Products

Ipad Os Ipados Iphone Os and 5 more

CVE-2021-30887

webkitgtk: Logic issue leading to Content Security Policy bypass

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 6 more

CVE-2021-30884

webkitgtk: CSS compositing issue leading to revealing of the browsing history

The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history.

CVSS 3.1 · 4.7 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 4 more

CVE-2021-30851

webkitgtk: Memory corruption issue leading to arbitrary code execution

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution.

CVSS 3.1 · 8.8 High EPSS 2.4% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 7 more

CVE-2021-30849

webkitgtk: Multiple memory corruption issue leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 1.9% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Itunes and 6 more

CVE-2021-30848

webkitgtk: Memory corruption issue leading to arbitrary code execution

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 3 more

CVE-2021-30846

webkitgtk: Memory corruption issue leading to arbitrary code execution

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 1 more

Products

Ipados Iphone Os Macos and 7 more

CVE-2021-30836

webkitgtk: Out-of-bounds read leading to memory disclosure

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 5 more

CVE-2021-30823

webkitgtk: Logic issue leading to HSTS bypass

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 5 more