site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2021-10-26-8 Additional information for APPLE-SA-2021-09-20-5 Safari 15 Safari 15 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212816. WebKit Available for: macOS Big Sur and macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved state handling. CVE-2021-30818: Amar Menezes (@amarekano) of Zon8Research Entry added October 25, 2021 WebKit Available for: macOS Big Sur and macOS Catalina Impact: An attacker in a privileged network position may be able to bypass HSTS Description: A logic issue was addressed with improved restrictions. CVE-2021-30823: David Gullasch of Recurity Labs Entry added October 25, 2021 WebKit Available for: macOS Big Sur and macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2021-30809: an anonymous researcher Entry added October 25, 2021 WebKit Available for: macOS Big Sur and macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2021-30846: Sergei Glazunov of Google Project Zero WebKit Available for: macOS Big Sur and macOS Catalina Impact: Processing maliciously crafted web content may lead to code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2021-30848: Sergei Glazunov of Google Project Zero WebKit Available for: macOS Big Sur and macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2021-30849: Sergei Glazunov of Google Project Zero WebKit Available for: macOS Big Sur and macOS Catalina Impact: Processing maliciously crafted web content may lead to code execution Description: A memory corruption vulnerability was addressed with improved locking. CVE-2021-30851: Samuel Groß of Google Project Zero Installation note: This update may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmF4hwwACgkQeC9qKD1p rhgS3g/+Lz9oG2wfFTsremHL92HCAd7cmiuwe4y24alEwkTZkieluBPO8EerW8GZ tbJMo/4HiZS4CCQELk9ysSqtMEKjSsMO3KYWLhYhcGZJaFGRCs8q1YPrUcq3N6TD dS1rC9zo9JW8BYDqSAVD4O4J0RF2RFk0UyY6j9wt3RCrCVYq5sE8YAW4WeLQ66T1 K5+7JQ29e+fBT8xvYkHk2iippzarHlVilgXmYeGLE1l3BQshF/uAbv3oNe54TISY VVaez8iglBcOqRfty7xQxrGhg4uoRZfkF8ewxagyqn/23Rgsj1mknKbvNd19q43c oNjcYiBE1KQjd584TXucjg0K8tl+EV1IbqqU8K1OwdqLKp4u/+26U3AUzRs0Ydk6 morCLuv41keDqMnx3Cmi7SZX1ACBskbbFzeYcZsHleoBI3qic1LmG/SgZiTP/z5z r40389hNRQ//RNn0+IuXohTQw4oc4Hl+019aYCx07isa/H2VQmB2zjHbFO0uRfrV Q5Kv90g7MquXfS3YtJKg52THmj1HK32PDwXg62M/PZw3FrLZxQ/8ICju44Lx8kok 4aPN1U7CEoikeitILQ3Xkz2jnHSKmK4q9ko6xsJMz9DmGp+dYAXdI23kfnf8QIRs TsIbNC94c1PkWr5ke2EzLTeFLCyM/6odrzwu6TcGsC+OuMOAjKg= =ZEP6 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com