SB2022012635 - Multiple vulnerabilities in Apple macOS Monterey
Published: January 26, 2022 Updated: May 15, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2022-22584)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in ColorSync. A remote attacker can create a specially crafted ICC images, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Security restrictions bypass (CVE-ID: CVE-2022-22578)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to a logic error in Crash Reporter. A malicious application can execute arbitrary code with root privileges.
3) Link following (CVE-ID: CVE-2022-22585)
The vulnerability allows a malicious application to gain access to sensitive information.
The vulnerability exists due to incorrect path validation logic for symlinks in iCloud. A malicious application can access user's files.
4) Buffer overflow (CVE-ID: CVE-2022-22587)
The vulnerability allows a malicious application to execute arbitrary code with elevated privileges.
The vulnerability exists due to a boundary error within the IOMobileFrameBuffer subsystem. A malicious application can trigger buffer overflow and execute arbitrary code with kernel privileges.
Note, the vulnerability is being actively exploited in the wild.
5) Buffer overflow (CVE-ID: CVE-2022-22593)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in macOS kernel. A local user or malicious application can trigger buffer overflow and execute arbitrary code with kernel privileges.
6) Out-of-bounds read (CVE-ID: CVE-2022-22579)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary condition in Model I/O when processing STL files. A remote attacker can create a specially crafted STL file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory or execute arbitrary code on the system.
7) Security restrictions bypass (CVE-ID: CVE-2022-22583)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper permissions management in PackageKit. A malicious application can access restricted files.
8) Code Injection (CVE-ID: CVE-2022-22589)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code on the system.
The vulnerability exists due to improper input validation in WebKit when processing email messages. A remote attacker can trick the victim to open a specially crafted email message and execute arbitrary JavaScript code on the system.
9) Use-after-free (CVE-ID: CVE-2022-22590)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to open a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
10) Security features bypass (CVE-ID: CVE-2022-22592)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a logic issue when processing HTML content in WebKit. A remote attacker can create a specially crafted web page, trick the victim into visiting it and prevent Content Security Policy from being enforced.
11) Information disclosure (CVE-ID: CVE-2022-22594)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a cross-origin issue in the IndexDB API within the WebKit Storage. A remote attacker can trick the victim to visit a specially crafted website and gain access to sensitive information, locally stored by WebKit.
12) Out-of-bounds write (CVE-ID: CVE-2022-22586)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in AMD Kernel in macOS. A local user can run a specially crafted program to trigger an out-of-bounds write error and execute arbitrary code with elevated privileges.
13) Buffer overflow (CVE-ID: CVE-2022-22591)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in Intel Graphics Driver. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with kernel privileges.
14) Path traversal (CVE-ID: CVE-2022-22676)
The vulnerability allows a local user to delete arbitrary files on the system.
The vulnerability exists due to input validation error when processing directory traversal sequences within the PKInstallService in PackageKit. A local user can manipulate the filename and delete arbitrary files on the system.
15) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-22646)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists in PackageKit due to improperly imposed security restrictions. A local application can modify protected parts of the file system.
Remediation
Install update from vendor's website.