SB2023072444 - Multiple vulnerabilities in Apple macOS Ventura
Published: July 24, 2023 Updated: December 26, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 77 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32429)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper restriction checks in SystemMigration. A local application can bypass Privacy preferences.
2) Out-of-bounds read (CVE-ID: CVE-2023-38258)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing 3D models in Model I/O. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
3) Out-of-bounds read (CVE-ID: CVE-2023-38421)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing 3D models in Model I/O. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
4) NULL pointer dereference (CVE-ID: CVE-2023-2953)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the ber_memalloc_x() function. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.
5) Information disclosure (CVE-ID: CVE-2023-38259)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a logic error in PackageKit. A local application can gain unauthorized access to sensitive information.
6) Security features bypass (CVE-ID: CVE-2023-38564)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to an error in PackageKit. A local application can modify protected parts of the file system.
7) Security features bypass (CVE-ID: CVE-2023-38602)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to an error in PackageKit. A local application can modify protected parts of the file system.
8) Improper access control (CVE-ID: CVE-2023-32442)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper access restrictions in Shortcuts. A local application can modify sensitive Shortcuts app settings.
9) Out-of-bounds read (CVE-ID: CVE-2023-32443)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in sips. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
10) Improper access control (CVE-ID: CVE-2023-38608)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Voice Memos. A local application can access user-sensitive data.
11) Untrusted search path (CVE-ID: CVE-2023-38565)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to usage of an untrusted search path in libxpc. A local application can execute arbitrary code with root privileges.
12) Security features bypass (CVE-ID: CVE-2023-38572)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error in WebKit when handling Same Origin Policy. A remote attacker can bypass Same Origin Policy restrictions.
13) Buffer overflow (CVE-ID: CVE-2023-38594)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
14) Buffer overflow (CVE-ID: CVE-2023-38595)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
15) Buffer overflow (CVE-ID: CVE-2023-38600)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
16) Buffer overflow (CVE-ID: CVE-2023-38611)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
17) Buffer overflow (CVE-ID: CVE-2023-37450)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
18) Buffer overflow (CVE-ID: CVE-2023-38597)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit Process Model. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
19) Information disclosure (CVE-ID: CVE-2023-38133)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in WebKit Process Model. A remote attacker can gain unauthorized access to sensitive information on the system.
20) Input validation error (CVE-ID: CVE-2023-38593)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a logic issue in libxpc. A local application can perform a denial of service (DoS) attack.
21) Input validation error (CVE-ID: CVE-2023-38603)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in OS kernel. A remote attacker can send specially crafted input to the system and perform a denial of service (DoS) attack.
22) Buffer overflow (CVE-ID: CVE-2023-38580)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
23) Input validation error (CVE-ID: CVE-2023-32418)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in Grapher. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.
24) Security features bypass (CVE-ID: CVE-2023-36862)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a downgrade issue affecting Intel-based Mac computers in AppleMobileFileIntegrity. A local application can determine a user’s current location.
25) Security features bypass (CVE-ID: CVE-2023-32364)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to a logic error in AppSandbox. A local application can bypass sandbox restrictions.
26) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-35983)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Assets. A local application can modify protected parts of the file system.
27) Use-after-free (CVE-ID: CVE-2023-28319)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a use-after-free error when checking the SSH sha256 fingerprint. A remote attacker can use the application to connect to a malicious SSH server, trigger a use-after-free error and gain access to potentially sensitive information.
Successful exploitation of the vulnerability requires usage of the the CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 option, and also CURLOPT_VERBOSE or CURLOPT_ERRORBUFFER options have to be set.
28) Improper synchronization (CVE-ID: CVE-2023-28320)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper synchronization when resolving host names using the alarm() and siglongjmp() function. A remote attacker can force the application to crash by influencing contents of the global buffer.
29) Improper certificate validation (CVE-ID: CVE-2023-28321)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to improper certificate validation when matching wildcards in TLS certificates for IDN names. A remote attacker crate a specially crafted certificate that will be considered trusted by the library.
Successful exploitation of the vulnerability requires that curl is built to use OpenSSL, Schannel or Gskit.
30) Expected behavior violation (CVE-ID: CVE-2023-28322)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.
31) Information disclosure (CVE-ID: CVE-2023-32416)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in the Find My feature. A local application can read sensitive location information.
32) Input validation error (CVE-ID: CVE-2023-36854)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in Grapher. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.
33) Buffer overflow (CVE-ID: CVE-2023-38606)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
34) Buffer overflow (CVE-ID: CVE-2023-32734)
The vulnerability allows a local application can escalate privileges on the system.
The vulnerability exists due to a boundary error in OS kernel. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
35) Buffer overflow (CVE-ID: CVE-2023-32441)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
36) Buffer overflow (CVE-ID: CVE-2023-38261)
The vulnerability allows a local application can escalate privileges on the system.
The vulnerability exists due to a boundary error in OS kernel. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
37) Buffer overflow (CVE-ID: CVE-2023-38424)
The vulnerability allows a local application can escalate privileges on the system.
The vulnerability exists due to a boundary error in OS kernel. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
38) Buffer overflow (CVE-ID: CVE-2023-38425)
The vulnerability allows a local application can escalate privileges on the system.
The vulnerability exists due to a boundary error in OS kernel. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
39) Use-after-free (CVE-ID: CVE-2023-32381)
The vulnerability allows a local application to escalate privileges on the system.
40) Use-after-free (CVE-ID: CVE-2023-32433)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.
41) Use-after-free (CVE-ID: CVE-2023-35993)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.
42) Buffer overflow (CVE-ID: CVE-2023-38410)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
43) State Issues (CVE-ID: CVE-2023-32654)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a state issue in Time Zone. A local user can read information belonging to another user.
44) Use-after-free (CVE-ID: CVE-2023-38598)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with kernel privileges.
45) Out-of-bounds write (CVE-ID: CVE-2023-38604)
The vulnerability allows a local application to escalate privileges on the system.
46) Buffer overflow (CVE-ID: CVE-2023-38590)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the OS kernel. A remote attacker can send specially crafted data to the system, trigger memory corruption and crash the kernel.
47) Buffer overflow (CVE-ID: CVE-2023-34425)
The vulnerability allows a local application to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
48) Code Injection (CVE-ID: CVE-2023-38609)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper input validation in PackageKit. A local application can pass specially crafted data to the affected application and bypass certain Privacy preferences.
49) Integer overflow (CVE-ID: CVE-2023-36495)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to integer overflow within the OS kernel. A local application can trigger an integer overflow and execute arbitrary code with kernel privileges.
50) UNIX symbolic link following (CVE-ID: CVE-2023-38571)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to a symlink following issue within the Music component. A local application can create a specially crafted symbolic link to a critical file on the system and bypass Privacy preferences.
51) Security features bypass (CVE-ID: CVE-2023-38601)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper access restrictions within the Net-SNMP component. A local application can modify protected parts of the file system.
52) Security features bypass (CVE-ID: CVE-2023-32444)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to a logic error in NSSpellChecker. A local application can bypass sandbox restrictions.
53) Out-of-bounds read (CVE-ID: CVE-2023-37285)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary condition within the OS kernel. A local application can trigger an out-of-bounds read error and execute arbitrary code with kernel privileges.
54) Universal cross-site scripting (CVE-ID: CVE-2023-32445)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in WebKit. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of arbitrary website.
55) Use-after-free (CVE-ID: CVE-2023-34241)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in cupsdAcceptClient(). A remote attacker can cause a denial of service condition on the target system.
56) Buffer overflow (CVE-ID: CVE-2023-38592)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim to visit a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
57) Information disclosure (CVE-ID: CVE-2023-38599)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a logic issue in WebKit, related to user's privacy. A remote attacker can sensitive user information.
58) Information disclosure (CVE-ID: CVE-2023-38605)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the Weather application. A local application can determine a user’s current location.
59) Race condition (CVE-ID: CVE-2023-38616)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition in AMD subsystem. A local user can exploit the race and execute arbitrary code with kernel privileges.
60) Information disclosure (CVE-ID: CVE-2023-40392)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the CFNetwork. A local application can read sensitive location information.
61) Integer overflow (CVE-ID: CVE-2022-3970)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the TIFFReadRGBATileExt() function in libtiff/tif_getimage.c. A remote attacker can trick the victim to open a specially crafted TIFF file, trigger an integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
62) Input validation error (CVE-ID: CVE-2023-28200)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation within the OS kernel. A local application can disclose kernel memory.
63) Buffer overflow (CVE-ID: CVE-2023-29491)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing malformed data in a terminfo database file. A local user can trigger memory corruption and execute arbitrary code on the target system.
64) Code Injection (CVE-ID: CVE-2023-40397)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code on the target system.
The vulnerability exists due to improper input validation. A remote attacker can trick the victim to visit a specially crafted webpage and execute arbitrary JavaScript code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
65) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-42828)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to crontabs does not properly impose security restrictions. A local application can execute arbitrary code with root privileges.
66) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-40439)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Accounts application stores sensitive information in log files. A malicious application can read the log files and gain access to sensitive location information.
67) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-40437)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to "Find My" features stores sensitive information into log files. A local application can read the log files and gain access to sensitive location information.
68) Cryptographic issues (CVE-ID: CVE-2023-40440)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a state error within the Mail subsystem. The S/MIME encrypted email messages can be inadvertently sent unencrypted.
69) Heap-based buffer overflow (CVE-ID: CVE-2023-1916)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the extractImageSection() function in tools/tiffcrop.c. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.
70) State Issues (CVE-ID: CVE-2023-42829)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state issue in OpenSSH implementation. A local application can access SSH passphrases.
71) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-42831)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper security restrictions within the Security component. A local application can fingerprint the user.
72) Race condition (CVE-ID: CVE-2023-42832)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a race condition within the Software Update feature. A local application can exploit the race and execute arbitrary code with root privileges.
73) Out-of-bounds write (CVE-ID: CVE-2023-1801)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the SMB protocol decoder. A remote attacker can send specially crafted over the network, trigger an out-of-bounds write and crash the application.
74) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2023-2426)
The vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to an out-of-range pointer offset within the mb_charlen() function in mbyte.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.
75) NULL pointer dereference (CVE-ID: CVE-2023-2609)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the get_register() function in register.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.
76) Integer overflow (CVE-ID: CVE-2023-2610)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the regtilde() function in regexp.c. A remote attacker can trick the victim to open a specially crafted file, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
77) Buffer overflow (CVE-ID: CVE-2023-42866)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim to open a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.