KLA12155 Multiple vulnerabilities in Apple iCloud

Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to obtain sensitive information, perform cross-site scripting attack.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in CoreText can be exploited to obtain sensitive information.
2. A memory initialization vulnerability in CFNetwork can be exploited to obtain sensitive information.
3. A cross-site-scripting (XSS) vulnerability in WebKit can be exploited to perform cross-site scripting attack.
4. A use after free vulnerability in WebRTC can be exploited to cause denial of service or execute arbitrary code.

Original advisories

About the security content of iCloud for Windows 12.3

Related products

Apple-iCloud

CVE list

CVE-2021-1811 high

CVE-2021-1857 high

CVE-2021-1825 high

CVE-2020-7463 high

Solution

Update to the latest version

Download iCloud

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

• Apple iCloud for Windows earlier than 12.3