A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, iOS 15 and iPadOS 15, watchOS 8, macOS Big Sur 11.6. An application may be able to access restricted files.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ipados | Apple | * | 14.8 (excluding) |
| Iphone_os | Apple | * | 14.8 (excluding) |
| Mac_os_x | Apple | * | 10.15.7 (excluding) |
| Mac_os_x | Apple | 10.15.7 (including) | 10.15.7 (including) |
| Mac_os_x | Apple | 10.15.7-security_update_2020-001 (including) | 10.15.7-security_update_2020-001 (including) |
| Mac_os_x | Apple | 10.15.7-security_update_2021-001 (including) | 10.15.7-security_update_2021-001 (including) |
| Mac_os_x | Apple | 10.15.7-security_update_2021-002 (including) | 10.15.7-security_update_2021-002 (including) |
| Mac_os_x | Apple | 10.15.7-security_update_2021-003 (including) | 10.15.7-security_update_2021-003 (including) |
| Mac_os_x | Apple | 10.15.7-security_update_2021-004 (including) | 10.15.7-security_update_2021-004 (including) |
| Mac_os_x | Apple | 10.15.7-supplemental_update (including) | 10.15.7-supplemental_update (including) |
| Macos | Apple | * | 11.6 (excluding) |
| Tvos | Apple | * | 15.0 (excluding) |
| Watchos | Apple | * | 8.0 (excluding) |