CERT-In Vulnerability Note
CIVN-2023-0222
Multiple Vulnerabilities in Apple macOS
Original Issue Date:July 28, 2023
Severity Rating: HIGH
Software Affected
- Apple macOS Ventura versions prior to 13.5
- Apple macOS Monterey versions prior to 12.6.8
- Apple macOS Big Sur versions prior to 11.7.9
Overview
Multiple vulnerabilities have been reported in Apple macOS which could be exploited by an attacker to execute arbitrary code, elevated privileges, gain access to sensitive information or cause denial-of-service conditions on the targeted system.
Description
These vulnerabilities exist in Apple macOS due to improper memory handling in Apple Neural Engine; logic issue in App Sandbox; logic issues in Find My; improper data protection in Assets; multiple issues in curl; downgrade issue in AppleMobileFileIntegrity; improper checks in Grapher; buffer overflow issue, use-after-free issue, integer overflow, out of bounds read and write issue, improper checks and improper state management in the kernel component; improper validation and improper checks in libxpc; improper checks in Model I/O; improper memory handling in OpenLDAP; injection issue, logic issue, improper checks, improper restrictions and permissions issue in PackageKit; access issue in Shortcuts; out-of-bounds read flaw in sips; improper checks in SystemMigration; permissions flaw in Voice Memos; improper checks and logic issue in Webkit component; improper checks in WebKit Process Model and improper checks in WebKit Web Inspector. A remote attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted web content.
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, elevated privileges, gain access to sensitive information or cause denial-of-service conditions on the targeted system.
Note: The vulnerabilities (CVE-2023-38606, CVE-2023-37450, and CVE-2023-41990) are being exploited in the wild.
Solution
Apply appropriate fixes issued by the vendor:
https://support.apple.com/en-us/HT213843
https://support.apple.com/en-us/HT213844
https://support.apple.com/en-us/HT213845
https://support.apple.com/en-us/HT213842
Vendor Information
Apple
https://support.apple.com/en-us/HT213843
https://support.apple.com/en-us/HT213844
https://support.apple.com/en-us/HT213845
https://support.apple.com/en-us/HT213842
References
https://support.apple.com/en-us/HT213843
https://support.apple.com/en-us/HT213844
https://support.apple.com/en-us/HT213845
https://support.apple.com/en-us/HT213842
CVE Name
CVE-2023-28319
CVE-2023-28320
CVE-2023-28321
CVE-2023-28322
CVE-2023-2953
CVE-2023-32364
CVE-2023-32381
CVE-2023-32416
CVE-2023-32418
CVE-2023-32429
CVE-2023-32433
CVE-2023-32441
CVE-2023-32442
CVE-2023-32443
CVE-2023-32734
CVE-2023-35983
CVE-2023-35993
CVE-2023-36854
CVE-2023-36862
CVE-2023-37450
CVE-2023-38133
CVE-2023-38258
CVE-2023-38259
CVE-2023-38261
CVE-2023-38410
CVE-2023-38421
CVE-2023-38424
CVE-2023-38425
CVE-2023-38564
CVE-2023-38565
CVE-2023-38572
CVE-2023-38580
CVE-2023-38593
CVE-2023-38594
CVE-2023-38595
CVE-2023-38597
CVE-2023-38600
CVE-2023-38602
CVE-2023-38603
CVE-2023-38606
CVE-2023-38608
CVE-2023-38611
CVE-2023-41990
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|