Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0467 APPLE-SA-2021-02-09-1 macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002 10 February 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Big Sur Catalina Mojave Publisher: Apple Operating System: Mac OS Impact/Access: Root Compromise -- Existing Account Execute Arbitrary Code/Commands -- Existing Account Increased Privileges -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2021-3156 CVE-2021-1806 CVE-2021-1805 Reference: ESB-2021.0408 ESB-2021.0293 ESB-2021.0330.2 ESB-2021.0329.3 Original Bulletin: https://support.apple.com/HT212177 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2021-02-09-1 macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002 macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212177. macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update*, macOS Mojave 10.14.6 Security Update 2021-002 Intel Graphics Driver Available for: macOS Big Sur 11.2, macOS Catalina 10.15.7 Impact: An application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write was addressed with improved input validation. CVE-2021-1805: ABC Research s.r.o. working with Trend Micro Zero Day Initiative Intel Graphics Driver Available for: macOS Big Sur 11.2, macOS Catalina 10.15.7 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with additional validation. CVE-2021-1806: ABC Research s.r.o. working with Trend Micro Zero Day Initiative Sudo Available for: macOS Big Sur 11.2, macOS Catalina 10.15.7, macOS Mojave 10.14.6 Impact: A local attacker may be able to elevate their privileges Description: This issue was addressed by updating to sudo version 1.9.5p2. CVE-2021-3156: Qualys * After installing this update, the build number for macOS Catalina 10.15.7 is 19H524. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ - -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAmAi22YACgkQZcsbuWJ6 jjAAQQ//QqBxmotc7s4GOHmQfGryZ2A7iJvoTc2B9EGuTJ32C5W1venGd2HaKKq8 okD5kxyqeH351MkHgTHOqS7S+f41WVm+ICnOQ8BIFmmff5fRZm0H1L05y9Ze5EI0 tkI2ztNr3ci59IC5YCzGX94FIHESW3pcLmOQrGRDSkZk+UjX8WijUWEdkueDR0NV /4jYZqW1p0u+MNaFfIxZTb5ODt+2BkTS81HPpDdPOMq9jaP3bR1dK+Dd2CX9qP5e SZ0dUOL487zQkvrnPIaykXBuaHg9Apqsc1BaY02DQlPYoYaTQn7LFUkw2CICDSiF lTYeZecn0L3EHAEzsLG1Rh0UbJZ/UZuB1zMZhrn49XTpbqE5VQHtAF8I3cQxZa7A Y9HkTVygJP/Vqg8ArNKvVE8SUjH5JWkFvcWn7Zpzshx/KsQGfnbLVk/o9LYKYTjX 7m56/XqfyGyi3ookWMHHcQhRvbKU0NF4yaQyoP1xk77c9Bukno5l3IfJmeMyQHK+ HsEMO+vBd/+jUDDSKB78ygTQRMudUULz2nf5WgxlnAReBa22x3Ed9eC3hCoVUfNV U5AwAm06BLZKItQ52xxPnZKY15tii57jZIfaB9iXi5Yzyes9CZ7gfu7HrS0LU41k LPM4m0rOJWj+nFelY/PormPiGpJsKMj1FuDtvkGbXnl/IhRMGzE= =qIKx - -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/apple-security-announce%40auscert.org.au This email sent to apple-security-announce@auscert.org.au - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYCNxZeNLKJtyKPYoAQjNHhAAoFwJoeOawaNQzqlXzKnQ2KK1OF3iYkBk I7yEVXhgAGRisNhDky0m/bdO9Zhr7DSdWU3cezBi0+js7Adx/r1GZYZE+rxe+G7X iAeGA1Q9fGRqNYECSfD6z7smBzdTIf8gCwc7YPANK/8DmKwY8iZvltOUZS/Ox2ct hUa5NyyTv8Zq8sRdI7bGhIOzxcdruG9SNmvGH61oK2ikMcakJIP9Y2odF4PUfMjg Ax2d+g+X8n/LzXc9Ko0+lip3LbPyX7diigirOf8VKwqNrnUvViCMMflwfcdGMF42 DWnzbMWLnUrc5WqPoeIkgNFZW21J4bKaLJ01+ryTA8+7n4O16bVjV13LOF6+W4o4 7E1dhfQmTjDTJ957hIYXIbxREu9S16p38pOlwow2Ap/MjnD/Xo8+arsMyS9WePfZ EmzEB/HX15yprMAKZQzXJpcvx64gy4HzT5IckWGywc4IZaYTmHLXJnuzeYp/3r4f PNxEANLNf1/aLxWUiXCIVcsQT16+jfm+wL+XrbiBmTRV2rdmo10uQYe2+JdT8o4n G3Dr/IaLoqp7uTi6H9aLBcW0oZu76ZyL2ttS6T11jQAnFY2ZDbSa2suqCK5qYO6d dIJyndO+r4KNzAPWnQITxhqjNkhGGla5z/7A/7aUd6iXzd/s5A9zQ0m2s+chZWHS ha8A+8so+SM= =hV64 -----END PGP SIGNATURE-----