====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN327
_____________________________________________________________________

DATE                : 16/06/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): iOS versions prior to 12.5.4.

=====================================================================
https://support.apple.com/en-us/HT212548
_____________________________________________________________________


About the security content of iOS 12.5.4

This document describes the security content of iOS 12.5.4.


About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or
confirm security issues until an investigation has occurred and patches
or releases are available. Recent releases are listed on the Apple
security updates page.

Apple security documents reference vulnerabilities by CVE-ID when
possible.

For more information about security, see the Apple Product Security
page.


iOS 12.5.4

Released June 14, 2021


Security

Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini
2, iPad mini 3, and iPod touch (6th generation)

Impact: Processing a maliciously crafted certificate may lead to
arbitrary code execution

Description: A memory corruption issue in the ASN.1 decoder was
addressed by removing the vulnerable code.

CVE-2021-30737: xerub


WebKit

Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini
2, iPad mini 3, and iPod touch (6th generation)

Impact: Processing maliciously crafted web content may lead to arbitrary
code execution. Apple is aware of a report that this issue may have been
actively exploited.

Description: A memory corruption issue was addressed with improved state
management.

CVE-2021-30761: an anonymous researcher


WebKit

Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini
2, iPad mini 3, and iPod touch (6th generation)

Impact: Processing maliciously crafted web content may lead to arbitrary
code execution. Apple is aware of a report that this issue may have been
actively exploited.

Description: A use after free issue was addressed with improved memory
management.


CVE-2021-30762: an anonymous researcher

Information about products not manufactured by Apple, or independent
websites not controlled or tested by Apple, is provided without
recommendation or endorsement. Apple assumes no responsibility with
regard to the selection, performance, or use of third-party websites or
products. Apple makes no representations regarding third-party website
accuracy or reliability. Contact the vendor for additional information.


Published Date: June 14, 2021


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================