CVE-2021-1789
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS
02 Description
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS
03 Exploitation and scoring
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2022-05-04. Federal remediation due 2022-05-25.
- SSVC decision
- ExploitationactiveCISA reports credible evidence of active exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 13.97% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 96.4% of scored records. A rank, not a probability.
- NVD base score
- 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2021-04-02 18:01Z5 YR AGO
- Last updated
- 2025-10-21 23:25Z1 YR AGO
- Reserved
- 2020-12-08
- Assigning CNA
- apple
- Record state
- PUBLISHED
- Severity
- High (CVSS 8.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-843Access of Resource Using Incompatible Type ('Type Confusion')Base
- Data version
- 5.1
- Document digest
- 970614a04e410e6c6312ec0d91bd6409d2fabe416f28ce2cdaee5a9c3867e194
05 Affected products
06 References
- support.apple.comhttps://support.apple.com/en-us/HT212147
- support.apple.comhttps://support.apple.com/en-us/HT212146
- support.apple.comhttps://support.apple.com/en-us/HT212148
- support.apple.comhttps://support.apple.com/en-us/HT212149
- support.apple.comhttps://support.apple.com/en-us/HT212152
- lists.fedoraproject.orgFEDORA-2021-864dc37032https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/
- lists.fedoraproject.orgFEDORA-2021-619711d709https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/
- security.gentoo.orgGLSA-202104-03https://security.gentoo.org/glsa/202104-03
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1789
07 Fixed in
AlmaLinux 8
- LibRaw Fixed in 0.19.5-3.el8
- LibRaw-devel Fixed in 0.19.5-3.el8
- accountsservice Fixed in 0.6.55-2.el8
- accountsservice-devel Fixed in 0.6.55-2.el8
- accountsservice-libs Fixed in 0.6.55-2.el8
- gdm Fixed in 1:40.0-15.el8
- gnome-autoar Fixed in 0.2.3-2.el8
- gnome-calculator Fixed in 3.28.2-2.el8
- gnome-classic-session Fixed in 3.32.1-20.el8
- gnome-control-center Fixed in 3.28.2-28.el8
- gnome-control-center-filesystem Fixed in 3.28.2-28.el8
- gnome-online-accounts Fixed in 3.28.2-3.el8
- gnome-online-accounts-devel Fixed in 3.28.2-3.el8
- gnome-session Fixed in 3.28.1-13.el8
- gnome-session-kiosk-session Fixed in 3.28.1-13.el8
- gnome-session-wayland-session Fixed in 3.28.1-13.el8
- gnome-session-xsession Fixed in 3.28.1-13.el8
- gnome-settings-daemon Fixed in 3.32.0-16.el8.alma
- gnome-shell Fixed in 3.32.2-40.el8
- gnome-shell-extension-apps-menu Fixed in 3.32.1-20.el8
- gnome-shell-extension-auto-move-windows Fixed in 3.32.1-20.el8
- gnome-shell-extension-common Fixed in 3.32.1-20.el8
- gnome-shell-extension-dash-to-dock Fixed in 3.32.1-20.el8
- gnome-shell-extension-desktop-icons Fixed in 3.32.1-20.el8
- gnome-shell-extension-disable-screenshield Fixed in 3.32.1-20.el8
- gnome-shell-extension-drive-menu Fixed in 3.32.1-20.el8
- gnome-shell-extension-gesture-inhibitor Fixed in 3.32.1-20.el8
- gnome-shell-extension-horizontal-workspaces Fixed in 3.32.1-20.el8
- gnome-shell-extension-launch-new-instance Fixed in 3.32.1-20.el8
- gnome-shell-extension-native-window-placement Fixed in 3.32.1-20.el8
- gnome-shell-extension-no-hot-corner Fixed in 3.32.1-20.el8
- gnome-shell-extension-panel-favorites Fixed in 3.32.1-20.el8
- gnome-shell-extension-places-menu Fixed in 3.32.1-20.el8
- gnome-shell-extension-screenshot-window-sizer Fixed in 3.32.1-20.el8
- gnome-shell-extension-systemMonitor Fixed in 3.32.1-20.el8
- gnome-shell-extension-top-icons Fixed in 3.32.1-20.el8
- gnome-shell-extension-updates-dialog Fixed in 3.32.1-20.el8
- gnome-shell-extension-user-theme Fixed in 3.32.1-20.el8
- gnome-shell-extension-window-grouper Fixed in 3.32.1-20.el8
- gnome-shell-extension-window-list Fixed in 3.32.1-20.el8
17 further packages in AlmaLinux 8 not shown (first 40 listed).
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Arch Linux
- wpewebkit Fixed in 2.30.6-1
Source: Arch Linux Security Tracker, the Arch Linux security team. Reformatted by exploit.cc.
CloudLinux 8
- LibRaw Fixed in 0.19.5-3.el8
- LibRaw-devel Fixed in 0.19.5-3.el8
- accountsservice Fixed in 0.6.55-2.el8
- accountsservice-devel Fixed in 0.6.55-2.el8
- accountsservice-libs Fixed in 0.6.55-2.el8
- gdm Fixed in 1:40.0-15.el8
- gnome-autoar Fixed in 0.2.3-2.el8
- gnome-calculator Fixed in 3.28.2-2.el8
- gnome-classic-session Fixed in 3.32.1-20.el8
- gnome-control-center Fixed in 3.28.2-28.el8
- gnome-control-center-filesystem Fixed in 3.28.2-28.el8
- gnome-online-accounts Fixed in 3.28.2-3.el8
- gnome-online-accounts-devel Fixed in 3.28.2-3.el8
- gnome-session Fixed in 3.28.1-13.el8
- gnome-session-kiosk-session Fixed in 3.28.1-13.el8
- gnome-session-wayland-session Fixed in 3.28.1-13.el8
- gnome-session-xsession Fixed in 3.28.1-13.el8
- gnome-settings-daemon Fixed in 3.32.0-16.el8.alma
- gnome-shell Fixed in 3.32.2-40.el8
- gnome-shell-extension-apps-menu Fixed in 3.32.1-20.el8
- gnome-shell-extension-auto-move-windows Fixed in 3.32.1-20.el8
- gnome-shell-extension-common Fixed in 3.32.1-20.el8
- gnome-shell-extension-dash-to-dock Fixed in 3.32.1-20.el8
- gnome-shell-extension-desktop-icons Fixed in 3.32.1-20.el8
- gnome-shell-extension-disable-screenshield Fixed in 3.32.1-20.el8
- gnome-shell-extension-drive-menu Fixed in 3.32.1-20.el8
- gnome-shell-extension-gesture-inhibitor Fixed in 3.32.1-20.el8
- gnome-shell-extension-horizontal-workspaces Fixed in 3.32.1-20.el8
- gnome-shell-extension-launch-new-instance Fixed in 3.32.1-20.el8
- gnome-shell-extension-native-window-placement Fixed in 3.32.1-20.el8
- gnome-shell-extension-no-hot-corner Fixed in 3.32.1-20.el8
- gnome-shell-extension-panel-favorites Fixed in 3.32.1-20.el8
- gnome-shell-extension-places-menu Fixed in 3.32.1-20.el8
- gnome-shell-extension-screenshot-window-sizer Fixed in 3.32.1-20.el8
- gnome-shell-extension-systemMonitor Fixed in 3.32.1-20.el8
- gnome-shell-extension-top-icons Fixed in 3.32.1-20.el8
- gnome-shell-extension-updates-dialog Fixed in 3.32.1-20.el8
- gnome-shell-extension-user-theme Fixed in 3.32.1-20.el8
- gnome-shell-extension-window-grouper Fixed in 3.32.1-20.el8
- gnome-shell-extension-window-list Fixed in 3.32.1-20.el8
17 further packages in CloudLinux 8 not shown (first 40 listed).
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- webkit2gtk Fixed in 2.30.6-1
- wpewebkit Fixed in 2.30.6-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- webkit2gtk Fixed in 2.30.6-1
- wpewebkit Fixed in 2.30.6-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- webkit2gtk Fixed in 2.30.6-1
- wpewebkit Fixed in 2.30.6-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 16.04 LTS
- qtwebkit-opensource-src No fix yet
- qtwebkit-source No fix yet
- webkit2gtk No fix yet
- webkitgtk No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- qtwebkit-opensource-src No fix yet
- qtwebkit-source No fix yet
- webkit2gtk Fixed in 2.30.6-0ubuntu0.18.04.1
- webkitgtk No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- qtwebkit-opensource-src No fix yet
- webkit2gtk Fixed in 2.30.6-0ubuntu0.20.04.1
- wpewebkit No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 22.04 LTS
- qtwebkit-opensource-src No fix yet
- wpewebkit No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 24.04 LTS
- qtwebkit-opensource-src No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.