The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
14 Dec 2022 Apple iOS Memory corruption
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple safari 16.2, apple tvos 16.2, apple iphone os 16.1.2, apple ipados 15.7.2, apple iphone os 15.7.2 and 1 older
- CISA due date
- 4 Jan 2023
- Weakness
- CWE-843
25 Oct 2022 Apple iOS and iPadOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 16.1, apple ipados 15.7.1, apple iphone os 15.7.1
- CISA due date
- 15 Nov 2022
- Weakness
- CWE-20, CWE-787
14 Sep 2022 Apple iOS, iPadOS, and macOS Memory corruption
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.7, apple iphone os 15.7, apple macos 12.6, apple macos 11.7
- CISA due date
- 5 Oct 2022
- Weakness
- CWE-20, CWE-787
8 Sep 2022 Apple iOS, iPadOS, and macOS Security flaw
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.6, apple iphone os 13.6, apple mac os x 10.15.6
- CISA due date
- 29 Sep 2022
25 Aug 2022 WebRTC Memory corruption
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 103.0.5060.114, apple ipados 15.6, apple iphone os 15.6, apple tvos 15.6, apple macos 12.5 and 5 older
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-122
25 Aug 2022 Apple iOS, macOS, watchOS Remote code execution
A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.8, apple iphone os 14.8, apple iphone os 12.5.5, apple macos 11.6, apple mac os x 10.15.7 and 1 older
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-20, CWE-502
18 Aug 2022 Apple iOS and macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.6.1, apple iphone os 15.6.1, apple macos 12.5.1, apple macos 11.7, apple watchos 9.0
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20, CWE-787
18 Aug 2022 Apple iOS and macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple safari 15.6.1, apple ipados 15.6.1, apple iphone os 15.6.1, apple macos 12.5.1, webkitgtk 2.36.7 and 1 older
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20, CWE-787
27 Jun 2022 Apple iOS and iPadOS Memory corruption
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.2, apple iphone os 15.2
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-119
27 Jun 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.6, apple iphone os 13.6, apple tvos 13.4.8
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-787
27 Jun 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.3.1, apple iphone os 13.3.1, apple tvos 13.3.1, apple mac os x 10.15.3, apple watchos 6.1.2
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-787
27 Jun 2022 Apple Multiple Products Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.3, apple tvos 12.3, apple mac os x 10.14.5, apple watchos 5.2.1
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-416
27 Jun 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.0, apple tvos 12.0, apple mac os x 10.14, apple watchos 5.0
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-119
24 May 2022 Apple iOS Memory corruption
WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 9.3.5
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-119
24 May 2022 Apple iOS Memory corruption
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 9.3.5
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-264
24 May 2022 Apple iOS Information disclosure
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 9.3.5
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-200
23 May 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, macOS Big Sur 11.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple tvos 15.1, apple ipados 15.0.2, apple iphone os 15.0.2, apple ipados 14.8.1, apple iphone os 14.8.1 and 2 older
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
23 May 2022 Apple iOS Memory corruption
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.1.4
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
23 May 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.1.4, apple mac os x 10.14.3
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
4 May 2022 Apple Multiple Products Memory corruption
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple tvos 14.4, apple macos 11.2, apple mac os x 10.15.7 and 3 older
- CISA due date
- 25 May 2022
- Weakness
- CWE-843
4 May 2022 Apple Multiple Products Memory corruption
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple itunes 12.9.4, apple iphone os 12.2, apple tvos 12.2, apple safari 12.1, apple icloud 7.11 and 1 older
- CISA due date
- 25 May 2022
- Weakness
- CWE-843
4 Apr 2022 Apple macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple tvos 15.5, apple ipados 15.4.1, apple iphone os 15.4.1, apple macos 12.3.1, apple macos 11.6.6 and 1 older
- CISA due date
- 25 Apr 2022
- Weakness
- CWE-20, CWE-125
4 Apr 2022 Apple macOS Memory corruption
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple macos 12.3.1, apple macos 11.6.6, apple mac os x 10.15.7
- CISA due date
- 25 Apr 2022
- Weakness
- CWE-20, CWE-125
11 Feb 2022 Apple iOS, iPadOS, and macOS Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.3.1, apple iphone os 15.3.1, apple safari 15.3, apple macos 12.2.1
- CISA due date
- 25 Feb 2022
- Weakness
- CWE-416
On Hacker News
Apple fixes actively exploited zero-day (CVE-2022-22620)10 Feb 2022 Apple OS X Path traversal
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple mac os x 10.10.3
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-254
10 Feb 2022 Apple OS X Memory corruption
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple mac os x 10.10.3, apple mac os x 10.10.0, apple iphone os 8.0, apple tvos 7.0
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-119
28 Jan 2022 Apple iOS and macOS Memory corruption
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.3, apple iphone os 15.3, apple macos 12.2, apple macos 11.6.3
- CISA due date
- 11 Feb 2022
- Weakness
- CWE-20, CWE-787
3 Nov 2021 Apple iOS, iPadOS, and macOS Memory corruption
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple iphone os 12.5.5, apple macos 11.2
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-843
3 Nov 2021 Apple Multiple Products Memory corruption
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- freedesktop poppler 22.09.0, apple ipados 14.8, apple iphone os 14.8, apple iphone os 12.5.5, apple macos 11.6 and 3 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-190
3 Nov 2021 Apple iOS, iPadOS, and macOS Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.8, apple iphone os 14.8, apple iphone os 12.5.5, apple macos 11.6
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.7.1, apple iphone os 14.7.1, apple macos 11.5.1, apple watchos 7.6.1
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 Apple iOS Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.5.4
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Apple iOS Memory corruption
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.5.4
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 Apple macOS Access control flaw
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple macos 11.4
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-862
3 Nov 2021 Apple iOS Memory corruption
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.5.3
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-119
3 Nov 2021 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple tvos 14.6, apple ipados 14.5.1, apple iphone os 14.5.1, apple iphone os 12.5.3, apple macos 11.3.1 and 1 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 Apple Multiple Products Memory corruption
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple tvos 14.6, apple ipados 14.5.1, apple iphone os 14.5.1, apple safari 14.1.1, apple iphone os 12.5.3 and 1 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-190
3 Nov 2021 Apple Multiple Products Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.5, apple iphone os 14.5, apple tvos 14.5, apple safari 14.1, apple iphone os 12.5.3 and 2 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Apple macOS Access control flaw
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple macos 11.3
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-862
3 Nov 2021 Apple iOS, iPadOS, and watchOS Cross-site scripting
This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4.2, apple iphone os 14.4.2, apple iphone os 12.5.2, apple watchos 7.3.3
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-79
On Hacker News
Universal XSS in iOS 1 comment3 Nov 2021 Apple iOS, iPadOS, and macOS Security flaw
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple macos 11.2, apple mac os x 10.15.7
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1173
3 Nov 2021 Apple iOS, iPadOS, and macOS Security flaw
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple macos 11.2, apple mac os x 10.15.7, webkitgtk 2.30.6
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1173
3 Nov 2021 Apple Multiple Products Race condition
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple tvos 14.4, apple macos 11.2, apple mac os x 10.15.7 and 2 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-362, CWE-667
3 Nov 2021 Apple Multiple Products Memory corruption
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.5.1, apple iphone os 13.5.1, apple tvos 13.4.6, apple mac os x 10.15.5, apple watchos 6.2.6
- CISA due date
- 3 May 2022
- Weakness
- CWE-415
3 Nov 2021 Apple iOS, iPadOS, and watchOS Memory corruption
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.5, apple iphone os 13.5, apple iphone os 12.4.7, apple watchos 6.2.5, apple watchos 5.3.7
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Apple iOS, iPadOS, and watchOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.5, apple iphone os 13.5, apple iphone os 12.4.7, apple watchos 6.2.5
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Apple Multiple Products Security flaw
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.2, apple iphone os 14.2, apple iphone os 12.4.9, apple macos 11.0.1, apple macos 10.15.7 and 3 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-665
3 Nov 2021 Apple Multiple Products Memory corruption
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.2, apple iphone os 14.2, apple itunes 12.11, apple iphone os 12.4.9, apple icloud 11.5 and 5 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-843
3 Nov 2021 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.2, apple iphone os 14.2, apple iphone os 12.4.9, apple macos 11.0.1, apple mac os x 10.15.7 and 3 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Apple iOS and macOS Security flaw
A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.1.4, apple mac os x 10.14.3
- CISA due date
- 3 May 2022
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.