Out-of-bounds read in Apple iOS and iPadOS - CVE-2022-42798
Published: October 27, 2022 / Updated: October 28, 2022
Vulnerability identifier: #VU68798
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-42798
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when parsing media files in the Audio subsystem. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and gain access to sensitive information.
Affected software
Apple iOS
iPadOS
macOS
watchOS
tvOS
iPadOS
macOS
watchOS
tvOS
How to mitigate CVE-2022-42798
Install updates from vendor's website.
Apple iOS - addressed in versions 15.7.1 19H117, 16.1 20B82
iPadOS - addressed in versions 15.7.1 19H117, 16.1 20B82
macOS - addressed in versions 11.7.1 20G918, 12.6.1 21G217, 13.0 22A380
watchOS - update to 9.1 20S75
tvOS - update to 16.1 20K71
iPadOS - addressed in versions 15.7.1 19H117, 16.1 20B82
macOS - addressed in versions 11.7.1 20G918, 12.6.1 21G217, 13.0 22A380
watchOS - update to 9.1 20S75
tvOS - update to 16.1 20K71
External References
Related Security Bulletins
- Multiple vulnerabilities in Apple iOS 15 and iPadOS 15
- Multiple vulnerabilities in Apple macOS Ventura
- Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
- Multiple vulnerabilities in Apple macOS Big Sur
- Multiple vulnerabilities in Apple watchOS
- Multiple vulnerabilities in Apple tvOS
- Multiple vulnerabilities in Apple macOS Monterey