SB2023012336 - Multiple vulnerabilities in Apple macOS Ventura
Published: January 23, 2023 Updated: September 11, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 36 secuirty vulnerabilities.
1) Security features bypass (CVE-ID: CVE-2023-23508)
The vulnerability allows a local application to bypass certain security restrictions.
The vulnerability exists due to an error within Windows Installer. A local application can bypass Privacy preferences.
2) Buffer overflow (CVE-ID: CVE-2023-23517)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Buffer overflow (CVE-ID: CVE-2023-23518)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Security features bypass (CVE-ID: CVE-2023-23511)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to an error within the Weather application. A local application can bypass Privacy preferences.
5) Use-after-free (CVE-ID: CVE-2022-3705)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling files within the qf_update_buffer() function in quickfix.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
6) Information disclosure (CVE-ID: CVE-2023-23505)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a privacy issue in Screen Time. A local application can gain unauthorized access to user's contact information.
7) Improper Privilege Management (CVE-ID: CVE-2023-23497)
The vulnerability allows a local application to escalate privileges.
The vulnerability exists due to improper privilege management in PackageKit. A local application can execute arbitrary code with root privileges.
8) Improper access control (CVE-ID: CVE-2023-23499)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in AppleMobileFileIntegrity. A local application can gain access to sensitive user information.
9) Buffer overflow (CVE-ID: CVE-2023-23504)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
10) Out-of-bounds read (CVE-ID: CVE-2023-23502)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the OS kernel. A local application can trigger an out-of-bounds read error and read contents of memory on the system.
11) Buffer overflow (CVE-ID: CVE-2023-23507)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within Intel Graphics Driver. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
12) Security features bypass (CVE-ID: CVE-2023-23493)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a logic error within DiskArbitration, related to mounting of an encryptoed volume. An encrypted volume may be unmounted and remounted by a different user without prompting for the password.
13) Buffer overflow (CVE-ID: CVE-2023-23513)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in dcerpc when mounting a malicious SMB share. A remote attacker can trick the victim to mount a malicious SMB share, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
14) Stack-based buffer overflow (CVE-ID: CVE-2022-35260)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when parsing .netrc file. A local user can pass a specially crafted file to the curl, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.
15) Expected behavior violation (CVE-ID: CVE-2022-32221)
The vulnerability allows a remote attacker to force unexpected application behavior.
The vulnerability exists due to a logic error for a reused handle when processing subsequent HTTP PUT and POST requests. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request, which used that callback. As a result, such behavior can influence application flow and force unpredictable outcome.
16) Cleartext transmission of sensitive information (CVE-ID: CVE-2022-42916)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error when parsing URL with IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. A remote attacker can bypass curl's HSTS check and trick it into using unencrypted HTTP protocol.
17) Double Free (CVE-ID: CVE-2022-42915)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing non-200 proxy HTTP responses for the following schemes: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, telnet. A remote attacker can trigger a double free error by forcing the application into connecting to resources that are not allowed by the configured proxy.
18) Input validation error (CVE-ID: CVE-2023-23519)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in ImageIO. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.
19) Out-of-bounds read (CVE-ID: CVE-2023-23500)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the OS kernel. A local application can trigger an out-of-bounds read error and read contents of memory on the system.
20) Improper Privilege Management (CVE-ID: CVE-2023-23506)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper privilege management in libxpc. A local application can gain access to sensitive user information.
21) Information disclosure (CVE-ID: CVE-2023-23498)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an error in Mail Drafts implementation when forwarding emails. The quoted original message may be selected from the wrong email when forwarding an email from an Exchange account and lead to information disclosure.
22) Information disclosure (CVE-ID: CVE-2023-23503)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a logic issue in Maps application. A local application can bypass Privacy preferences.
23) Improper access control (CVE-ID: CVE-2023-23510)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions. A local application can gain access to user’s Safari history.
24) Input validation error (CVE-ID: CVE-2023-23512)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient handling of cache in Safari. A remote attacker can trick the victim into visiting a website and perform a denial of service (DoS) attack.
25) Buffer overflow (CVE-ID: CVE-2023-23496)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
26) Out-of-bounds read (CVE-ID: CVE-2023-23501)
The vulnerability allows a local application to gain access to sensitive information.
The
vulnerability exists due to a boundary error within the Wi-Fi
component. A local application trigger an out-of-bounds read and read
kernel memory.
27) Buffer overflow (CVE-ID: CVE-2023-23531)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in the Foundation component. A local application can trigger memory corruption and execute arbitrary code out of its sandbox or with certain elevated privileges.
28) Race condition (CVE-ID: CVE-2023-23520)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a race condition in Crash Reporter. A local application can exploit the race and read arbitrary files on the system with root privileges.
29) Buffer overflow (CVE-ID: CVE-2023-23530)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in the Foundation component. A local application can trigger memory corruption and execute arbitrary code out of its sandbox or with certain elevated privileges.
30) Buffer overflow (CVE-ID: CVE-2023-23516)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
31) Buffer overflow (CVE-ID: CVE-2023-23539)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in dcerpc when mounting network shares. A remote attacker can trick the victim to mound a specially crafted Samba network share, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
32) Improperly implemented security check for standard (CVE-ID: CVE-2022-0108)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation in Navigation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
33) Buffer overflow (CVE-ID: CVE-2023-32393)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim to open a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
34) Improper access control (CVE-ID: CVE-2023-32438)
The vulnerability allows a local application to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in AppleMobileFileIntegrity. A local application can bypass implemented security restrictions and gain unauthorized access to the application.
35) Security features bypass (CVE-ID: CVE-2023-28208)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a logic error in the Messages component. A local user can send a text from a secondary eSIM despite configuring a contact to use a primary eSIM.
36) Buffer overflow (CVE-ID: CVE-2023-41990)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in FontParser. A remote attacker can trick the victim to open a specially crafted file or visit a malicious website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
Remediation
Install update from vendor's website.