SB2023092709 - Multiple vulnerabilities in Apple tvOS 17
Published: September 27, 2023 Updated: May 20, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 41 secuirty vulnerabilities.
1) Cleartext storage of sensitive information (CVE-ID: CVE-2023-40456)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Photos Storage saves edited photos to a temporary directory. A local application can view edited photos.
2) Input validation error (CVE-ID: CVE-2023-40400)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in libpcap. A remote attacker can pass specially crafted input to the system and execute arbitrary code on the system.
3) Improper access control (CVE-ID: CVE-2023-40454)
The vulnerability allows a local application to delete arbitrary files on the system.
The vulnerability exists due to improper access restrictions in libxpc. A local application can delete arbitrary files on the system.
4) Improper Authorization (CVE-ID: CVE-2023-41073)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper authorization in libxpc. A local application can gain unauthorized access to protected user data.
5) Out-of-bounds read (CVE-ID: CVE-2023-40403)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in libxslt. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
6) Error Handling (CVE-ID: CVE-2023-40427)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improved handling of caches in Maps. A local application can read sensitive location information.
7) Improper access control (CVE-ID: CVE-2023-41068)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in MobileStorageMounter. A local application can bypass implemented security restrictions and escalate privileges on the system.
8) Cleartext storage of sensitive information (CVE-ID: CVE-2023-40520)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Photos Storage saves edited photos to a temporary directory. A local application can view edited photos.
9) Buffer overflow (CVE-ID: CVE-2023-41984)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
10) Buffer overflow (CVE-ID: CVE-2023-41063)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Pro Res. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
11) Buffer overflow (CVE-ID: CVE-2023-40452)
The vulnerability allows a local application to overwrite arbitrary files on the system.
The vulnerability exists due to a boundary error in Sandbox. A local application can trigger memory corruption and overwrite arbitrary files on the system.
12) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-40419)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Simulator. A local application can escalate privileges on the system.
13) UNIX symbolic link following (CVE-ID: CVE-2023-41968)
The vulnerability allows a local application to read arbitrary files on the system.
The vulnerability exists due to a symlink following issue in StorageKit. A local application can read arbitrary files on the system.
14) Buffer overflow (CVE-ID: CVE-2023-41074)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
15) Buffer overflow (CVE-ID: CVE-2023-35074)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
16) Input validation error (CVE-ID: CVE-2023-40429)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input within the OS kernel. A local application can gain access to sensitive user data.
17) Security features bypass (CVE-ID: CVE-2023-41981)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to improper memory handling. A local user can bypass kernel memory mitigations and execute arbitrary code on the system.
18) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-40384)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in Airport. A local application can gain access to sensitive location information.
19) Out-of-bounds read (CVE-ID: CVE-2023-40399)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the Apple Neural Engine. A local user can trigger an out-of-bounds read error and read contents of memory on the system.
20) Security features bypass (CVE-ID: CVE-2023-40448)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to improper input validation in App Store. A remote attacker can trick the victim to visit a specially crafted website and break out of Web Content sandbox.
21) Buffer overflow (CVE-ID: CVE-2023-40432)
The vulnerability allows a local user to escalate privileges on the system.
22) Buffer overflow (CVE-ID: CVE-2023-41174)
The vulnerability allows a local user to escalate privileges on the system.
23) Buffer overflow (CVE-ID: CVE-2023-40409)
The vulnerability allows a local user to escalate privileges on the system.
24) Buffer overflow (CVE-ID: CVE-2023-40412)
The vulnerability allows a local user to escalate privileges on the system.
25) Use-after-free (CVE-ID: CVE-2023-41071)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a use-after-free error in Apple Neural Engine. A local application can read kernel memory.
26) Out-of-bounds read (CVE-ID: CVE-2023-40410)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the Apple Neural Engine. A local user can trigger an out-of-bounds read error and read contents of memory on the system.
27) Out-of-bounds read (CVE-ID: CVE-2023-40391)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in GPU Drivers. A local application can trigger an out-of-bounds read error and disclose kernel memory.
28) Error Handling (CVE-ID: CVE-2023-32361)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect error handling in AuthKit. A local application can gain access to user-sensitive data.
29) Out-of-bounds write (CVE-ID: CVE-2023-35984)
The vulnerability allows an attacker to compromise the affected system.
The vulnerability exists due to a boundary error in Bluetooth implementation. An attacker with physical proximity to the system can send specially crafted traffic to trigger an out-of-bounds write and execute arbitrary code.
30) Information disclosure (CVE-ID: CVE-2023-41065)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by bootp. A local application can read sensitive location information.
31) Improperly implemented security check for standard (CVE-ID: CVE-2023-38596)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists within the CFNetwork component, which fails to enforce App Transport Security. A local application can gain access to sensitive information.
32) Buffer overflow (CVE-ID: CVE-2023-40420)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in CoreAnimation. A remote attacker can trick the victim to visit a specially crafted website, trigger memory corruption and perform a denial of service (DoS) attack.
33) Input validation error (CVE-ID: CVE-2023-32396)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input in Dev Tools. A local application can escalate privileges on the system.
34) Error Handling (CVE-ID: CVE-2023-40395)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper error handling in Game Center. A local application can access contacts.
35) Use-after-free (CVE-ID: CVE-2023-40414)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.
36) Security features bypass (CVE-ID: CVE-2023-40528)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to an error within the Core Data component. A local application can bypass Privacy preferences.
37) Buffer overflow (CVE-ID: CVE-2023-40396)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in IOUserEthernet. A local user can trigger memory corruption and execute arbitrary code with kernel privileges.
38) Incorrect default permissions (CVE-ID: CVE-2023-42949)
The vulnerability allows a local application to access photos saved to temporary directory.
The vulnerability exists due to incorrect default permissions in Photos. A local application can access edited photos saved to a temporary directory.
39) Buffer overflow (CVE-ID: CVE-2023-42875)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
40) Use-after-free (CVE-ID: CVE-2023-39434)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to open a specially crafted website and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
41) Use-after-free (CVE-ID: CVE-2023-42970)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling HTML content. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Remediation
Install update from vendor's website.