SB2023032803 - Multiple vulnerabilities in Apple iOS 15 and iPadOS 15
Published: March 28, 2023 Updated: December 25, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2023-27941)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the OS kernel. A local application trigger an out-of-bounds read error and disclose kernel memory.
2) Type Confusion (CVE-ID: CVE-2023-23529)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error when parsing web content in WebKit. A remote attacker can trick the victim to visit a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.
Note, the vulnerability is being actively exploited in the wild.
3) Information disclosure (CVE-ID: CVE-2023-27954)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can track sensitive user information.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-27963)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper permissions checks in Shortcuts. A shortcut may be able to use sensitive data with certain actions without prompting the user.
5) Improper Authentication (CVE-ID: CVE-2023-28182)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error in the authentication process in NetworkExtension. A remote attacker can spoof a VPN server that is configured with EAP-only authentication on a device.
6) Out-of-bounds read (CVE-ID: CVE-2023-27949)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in Model I/O. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system or execute arbitrary code
7) Use-after-free (CVE-ID: CVE-2023-27969)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with kernel privileges.
8) Out-of-bounds read (CVE-ID: CVE-2023-23535)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in ImageIO. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
9) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-23541)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Accessibility feature stores sensitive information into log files. A local application can read the log files and gain access to sensitive data.
10) Buffer overflow (CVE-ID: CVE-2023-27946)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
11) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-27928)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Identity Services stores sensitive information into log files. A local application can read the log files and gain read information about a user’s contacts.
12) Out-of-bounds read (CVE-ID: CVE-2023-27956)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in FontParser. A remote attacker can create a specially crafted image file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
13) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-23537)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Find My feature stores sensitive location information into log files. A local application can read the log files and gain access to sensitive location data.
14) Out-of-bounds write (CVE-ID: CVE-2023-27936)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CommCenter. A local application can trigger an out-of-bounds write and execute arbitrary code with kernel privileges.
15) Observable discrepancy (CVE-ID: CVE-2023-23543)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists in the Camera app. A local sandboxed application can determine which app is currently using the camera.
16) Input validation error (CVE-ID: CVE-2023-27961)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in the Calendar application when processing calendar invitation. A remote attacker can exfiltrate user information.
17) Buffer overflow (CVE-ID: CVE-2023-23536)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error when the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
18) Input validation error (CVE-ID: CVE-2023-28200)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation within the OS kernel. A local application can disclose kernel memory.
19) Input validation error (CVE-ID: CVE-2023-28201)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit Web Inspector. A remote attacker can trick the victim to visit a specially crafted website and execute arbitrary code on the system.
20) Out-of-bounds write (CVE-ID: CVE-2023-32366)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error in FontParser. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
21) Integer overflow (CVE-ID: CVE-2023-28185)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the OS kernel. A local application can trigger an integer overflow and crash the kernel.
22) Type confusion (CVE-ID: CVE-2023-41075)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a type confusion error in libpthread. A local application can trigger a type confusion error and execute arbitrary code with kernel privileges.
23) Out-of-bounds read (CVE-ID: CVE-2023-27950)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in Model I/O when handling images. A remote attacker can create a specially crafted image file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
24) Use-after-free (CVE-ID: CVE-2023-28198)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim to open a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
25) Type Confusion (CVE-ID: CVE-2023-32358)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit PDF. A remote attacker can trick the victim to open a specially crafted PDF file, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.