SB2022012636 - Multiple vulnerabilities in Apple tvOS
Published: January 26, 2022 Updated: March 17, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2022-22584)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in ColorSync. A remote attacker can create a specially crafted ICC images, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Security restrictions bypass (CVE-ID: CVE-2022-22578)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to a logic error in Crash Reporter. A malicious application can execute arbitrary code with root privileges.
3) Link following (CVE-ID: CVE-2022-22585)
The vulnerability allows a malicious application to gain access to sensitive information.
The vulnerability exists due to incorrect path validation logic for symlinks in iCloud. A malicious application can access user's files.
4) Buffer overflow (CVE-ID: CVE-2022-22593)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in macOS kernel. A local user or malicious application can trigger buffer overflow and execute arbitrary code with kernel privileges.
5) Out-of-bounds read (CVE-ID: CVE-2022-22579)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary condition in Model I/O when processing STL files. A remote attacker can create a specially crafted STL file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory or execute arbitrary code on the system.
6) Use-after-free (CVE-ID: CVE-2022-22590)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to open a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
7) Security features bypass (CVE-ID: CVE-2022-22592)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a logic issue when processing HTML content in WebKit. A remote attacker can create a specially crafted web page, trick the victim into visiting it and prevent Content Security Policy from being enforced.
8) Code Injection (CVE-ID: CVE-2022-22589)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code on the system.
The vulnerability exists due to improper input validation in WebKit when processing email messages. A remote attacker can trick the victim to open a specially crafted email message and execute arbitrary JavaScript code on the system.
9) Information disclosure (CVE-ID: CVE-2022-22594)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a cross-origin issue in the IndexDB API within the WebKit Storage. A remote attacker can trick the victim to visit a specially crafted website and gain access to sensitive information, locally stored by WebKit.
Remediation
Install update from vendor's website.