The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6 Big Sur. It is, therefore, affected by multiple vulnerabilities including the following:

  - A use after free issue was addressed with improved memory management. Exploitation of this vulnerability may lead to     arbitrary code execution. (CVE-2021-30858)

  - An integer overflow was addressed with improved input validation. Exploitation of this vulnerability may lead to     arbitrary code execution. (CVE-2021-30860)

  - Insufficient checks when processing maliciously crafted dfont files may lead to arbitrary code     execution. (CVE-2021-30841, CVE-2021-30842, CVE-2021-30843)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 14.8. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A use after free issue due to incorrect memory management, which can lead to arbitrary code     execution when processing maliciously crafted web content. (CVE-2021-30858)

  - An integer overflow issue due to insufficient input validation, which can lead to arbitrary code     execution when processing a maliciously crafted PDF. (CVE-2021-30860)

  - Arbitrary code execution when processing a maliciously crafted dfont file. (CVE-2021-30841,     CVE-2021-30842, CVE-2021-30843)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 12.5.5. It is, therefore, affected by multiple vulnerabilities, as follows:

  - An integer overflow was addressed with improved input validation. Processing a maliciously crafted PDF may     lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively     exploited. (CVE-2021-30860)

  - A use after free issue was addressed with improved memory management. Processing maliciously crafted web     content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been     actively exploited. (CVE-2021-30858)

  - Incorrect state handling lead to a type confusing issue that allows a malicious application to execute     arbitrary code with kernel privileges. (CVE-2021-30869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is prior to Catalina Security Update 2021-005. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Arbitrary code execution when processing a maliciously crafted image. (CVE-2021-30835, CVE-2021-30847)

  - An integer overflow issue due to insufficient input validation, which can lead to arbitrary code     execution by an unauthenticated attacker when processing a maliciously crafted PDF. (CVE-2021-30860)

  - Arbitrary code execution when processing a maliciously crafted dfont file. (CVE-2021-30841,     CVE-2021-30842, CVE-2021-30843)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-21 (Poppler: Arbitrary Code Execution)

  - An integer overflow was addressed with improved input validation. This issue is fixed in Security Update     2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously     crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been     actively exploited. (CVE-2021-30860)

  - Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder     (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2     image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability     described by CVE-2022-38171 in Xpdf. (CVE-2022-38784)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of poppler installed on the remote host is prior to 21.12.0 / 22.09.0. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-244-01 advisory.

  - An integer overflow was addressed with improved input validation. This issue is fixed in Security Update     2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously     crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been     actively exploited. (CVE-2021-30860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
153429	macOS 11.x < 11.6 (HT212804)	Nessus	MacOS X Local Security Checks	9/16/2021	4/25/2023	high
153434	Apple iOS < 14.8 Multiple Vulnerabilities (HT212807)	Nessus	Mobile Devices	9/16/2021	4/8/2024	critical
153652	Apple iOS < 12.5.5 Multiple Vulnerabilities (HT212824)	Nessus	Mobile Devices	9/24/2021	4/8/2024	high
153432	macOS 10.15.x < Catalina Security Update 2021-005 Catalina (HT212805)	Nessus	MacOS X Local Security Checks	9/16/2021	4/25/2023	high
165536	GLSA-202209-21 : Poppler: Arbitrary Code Execution	Nessus	Gentoo Local Security Checks	9/29/2022	10/6/2023	high
164619	Slackware Linux 15.0 / current poppler Vulnerability (SSA:2022-244-01)	Nessus	Slackware Local Security Checks	9/1/2022	9/1/2022	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high