About the security content of Safari 14.1.1

This document describes the security content of Safari 14.1.1.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

Safari 14.1.1

WebKit

Available for: macOS Catalina and macOS Mojave

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2021-30749: an anonymous researcher and mipu94 of SEFCOM lab, ASU. working with Trend Micro Zero Day Initiative

CVE-2021-30734: Jack Dates of RET2 Systems, Inc. (@ret2systems) working with Trend Micro Zero Day Initiative

WebKit

Available for: macOS Catalina and macOS Mojave

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins.

CVE-2021-30744: Dan Hite of jsontop

WebKit

Available for: macOS Catalina and macOS Mojave

Impact: A malicious website may be able to access restricted ports on arbitrary servers

Description: A logic issue was addressed with improved restrictions.

CVE-2021-30720: David Schütz (@xdavidhu)

WebKit

Available for: macOS Catalina and macOS Mojave

Impact: A malicious application may be able to leak sensitive user information

Description: A logic issue was addressed with improved restrictions.

CVE-2021-30682: Prakash (@1lastBr3ath)

WebKit

Available for: macOS Catalina and macOS Mojave

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A use after free issue was addressed with improved memory management.

CVE-2021-21779: Marcin Towalski of Cisco Talos

WebKit

Available for: macOS Catalina and macOS Mojave

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue was addressed with improved state management.

CVE-2021-30689: an anonymous researcher

WebKit

Available for: macOS Catalina and macOS Mojave

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: An integer overflow was addressed with improved input validation.

CVE-2021-30663: an anonymous researcher

WebRTC

Available for: macOS Catalina and macOS Mojave

Impact: A remote attacker may be able to cause a denial of service

Description: A null pointer dereference was addressed with improved input validation.

CVE-2021-23841: Tavis Ormandy of Google

CVE-2021-30698: Tavis Ormandy of Google

Additional recognition

WebKit

We would like to acknowledge Chris Salls (@salls) of Makai Security for their assistance.