A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local user may be able to modify protected parts of the file system.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
| Link | Tags |
|---|---|
| https://support.apple.com/en-us/HT212317 | vendor advisory |
| https://support.apple.com/en-us/HT212323 | vendor advisory |
| https://support.apple.com/en-us/HT212324 | vendor advisory |
| https://support.apple.com/en-us/HT212325 | vendor advisory |
| https://support.apple.com/en-us/HT212326 | vendor advisory |
| https://support.apple.com/en-us/HT212327 | vendor advisory |