SB2022031435 - Multiple vulnerabilities in Apple macOS Catalina
Published: March 14, 2022 Updated: June 12, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 24 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2022-22614)
The vulnerability allows a local application to escalate privileges on the system.
2) UNIX symbolic link following (CVE-ID: CVE-2022-22582)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a symlink following issue in xar. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.
Successful exploitation of this vulnerability may result in privilege escalation.
3) Information disclosure (CVE-ID: CVE-2022-22662)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a cookie management issue in WebKit. A remote attacker can trick the victim to open a specially crafted webpage and gain access to sensitive information.
4) Improper access control (CVE-ID: CVE-2022-22650)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in QuickTime Player. A malicious plug-in can inherit the application's permissions and access user data.
5) Security restrictions bypass (CVE-ID: CVE-2022-22617)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to a logic error in PackageKit. A malicious application can bypass implemented security restrictions and escalate privileges on the system.
6) Improper Authentication (CVE-ID: CVE-2022-22656)
The vulnerability allows an attacker to bypass login window dialog.
The vulnerability exists due to an error in the Login Window feature. An attacker with physical access to the system can bypass authentication process and view the previous logged in user’s desktop from the fast user switching screen.
7) Improper Authentication (CVE-ID: CVE-2022-22647)
The vulnerability allows an attacker to bypass Login Window authentication.
The vulnerability exists due to an error in the Login Window feature. An attacker with physical access to the system can bypass the login window and gain unauthorized access to the system.
8) NULL pointer dereference (CVE-ID: CVE-2022-22638)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in macOS kernel. A local user can run a specially crafted program and perform a denial of service (DoS) attack.
9) Use-after-free (CVE-ID: CVE-2022-22615)
The vulnerability allows a local application to escalate privileges on the system.
10) Out-of-bounds write (CVE-ID: CVE-2022-22631)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the AppleGraphicsControl subsystem. A malicious application can trigger an out-of-bounds write and execute arbitrary code with root privileges.
11) Out-of-bounds write (CVE-ID: CVE-2022-22613)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in macOS kernel. A malicious application can trigger an out-of-bounds write error and execute arbitrary code with kernel privileges.
12) Type Confusion (CVE-ID: CVE-2022-22661)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to a type confusion error in Intel Graphics Driver subsystem. A local application can trigger a type confusion error and execute arbitrary code with kernel privileges.
13) Input validation error (CVE-ID: CVE-2022-22616)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in BOM when processing ZIP files. A remote attacker can trick the victim to open a specially crafted ZIP archive, bypass Gatekeeper checks and execute arbitrary code on the system.
14) Buffer overflow (CVE-ID: CVE-2022-22597)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing SCPT files. A malicious application can trigger buffer overflow and execute arbitrary code on the system.
15) Out-of-bounds read (CVE-ID: CVE-2022-22625)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in AppleScript. A remote attacker can trick the victim to run a specially crafted SCPT file, trigger an out-of-bounds read error and read contents of memory on the system.
16) Out-of-bounds read (CVE-ID: CVE-2022-22626)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in AppleScript. A remote attacker can trick the victim to run a specially crafted SCPT file, trigger an out-of-bounds read error and read contents of memory on the system.
17) Out-of-bounds read (CVE-ID: CVE-2022-22627)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in AppleScript. A remote attacker can trick the victim to run a specially crafted SCPT file, trigger an out-of-bounds read error and read contents of memory on the system.
18) Out-of-bounds read (CVE-ID: CVE-2022-22648)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in AppleScript. A remote attacker can trick the victim to run a specially crafted SCPT file, trigger an out-of-bounds read error and read contents of memory on the system.
19) Code Injection (CVE-ID: CVE-2022-22589)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code on the system.
The vulnerability exists due to improper input validation in WebKit when processing email messages. A remote attacker can trick the victim to open a specially crafted email message and execute arbitrary JavaScript code on the system.
20) Security restrictions bypass (CVE-ID: CVE-2022-22665)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a logic error in AppKit. A malicious application can execute arbitrary code with root privileges.
21) Buffer overflow (CVE-ID: CVE-2022-22672)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the MobileAccessoryUpdater component. A malicious application can trigger memory corruption and execute arbitrary code with elevated privileges.
22) UNIX symbolic link following (CVE-ID: CVE-2022-26688)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a symlink following issue within PackageKit. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.
Successful exploitation of this vulnerability may result in privilege escalation.
23) Improper Authorization (CVE-ID: CVE-2022-26691)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to an error in implementation of "Local" authorization mechanism. A remote attacker can authenticate as to CUPS as root/admin without the 32-byte secret key and execute arbitrary code on the system.
24) Type Confusion (CVE-ID: CVE-2022-46706)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a type confusion error in the Intel Graphics Driver. A local application can trigger a type confusion error and execute arbitrary code with elevated privileges.
Remediation
Install update from vendor's website.