SB2023032801 - Multiple vulnerabilities in Apple macOS Monterey
Published: March 28, 2023 Updated: January 3, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 40 secuirty vulnerabilities.
1) Security features bypass (CVE-ID: CVE-2023-27944)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper access restriction XPC. A local application can break out of its sandbox.
2) Division by zero (CVE-ID: CVE-2023-0512)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a divide by zero in the adjust_skipcol() function in move.c. A remote attacker can trick the victim to open a specially crafted file and crash the editor.
3) Heap-based buffer overflow (CVE-ID: CVE-2023-0433)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the same_leader() and utfc_ptr2len() function. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Information disclosure (CVE-ID: CVE-2023-28192)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the System Settings application. A local application can read sensitive location information.
5) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-23542)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to System Settings application stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-27963)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper permissions checks in Shortcuts. A shortcut may be able to use sensitive data with certain actions without prompting the user.
7) Security features bypass (CVE-ID: CVE-2023-28178)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper input validation in Sandbox component. A local application can bypass Privacy preferences.
8) Improper access control (CVE-ID: CVE-2023-27942)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Podcasts. A local application can gain access to user-sensitive data.
9) Improper access control (CVE-ID: CVE-2023-27962)
The vulnerability allows a local application to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in PackageKit. A local application can bypass implemented security restrictions and modify protected parts of the file system.
10) Improper Authentication (CVE-ID: CVE-2023-28182)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error in the authentication process in NetworkExtension. A remote attacker can spoof a VPN server that is configured with EAP-only authentication on a device.
11) Input validation error (CVE-ID: CVE-2023-28200)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation within the OS kernel. A local application can disclose kernel memory.
12) Buffer overflow (CVE-ID: CVE-2023-23540)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Apple Neural Engine feature. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
13) Memory corruption (CVE-ID: CVE-2023-27933)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local privileged application (with root permissions) can trigger memory corruption and execute arbitrary code with kernel privileges.
14) Use-after-free (CVE-ID: CVE-2023-23514)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with kernel privileges.
15) Buffer overflow (CVE-ID: CVE-2023-27946)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in ImageIO. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
16) Integer overflow (CVE-ID: CVE-2023-27937)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in Foundation when handling plist files. A remote attacker can trick the victim to download a malicious app, trigger an integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
17) Buffer overflow (CVE-ID: CVE-2023-27958)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in dcerpc. A remote attacker can send specially crafted traffic to the system, trigger memory corruption and execute arbitrary code.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
18) Buffer overflow (CVE-ID: CVE-2023-27953)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in dcerpc. A remote attacker can send specially crafted traffic to the system, trigger memory corruption and execute arbitrary code.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
19) Buffer overflow (CVE-ID: CVE-2023-27935)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in dcerpc. A remote attacker can send specially crafted traffic to the system, trigger memory corruption and execute arbitrary code.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
20) Out-of-bounds write (CVE-ID: CVE-2023-27936)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CommCenter. A local application can trigger an out-of-bounds write and execute arbitrary code with kernel privileges.
21) Improper access control (CVE-ID: CVE-2023-27955)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in ColorSync. A local application can bypass implemented security restrictions and read arbitrary files on the system.
22) Input validation error (CVE-ID: CVE-2023-27961)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in the Calendar application when processing calendar invitation. A remote attacker can exfiltrate user information.
23) Security features bypass (CVE-ID: CVE-2023-27951)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to improper input validation in Archive Utility. A remote attacker can trick the victim to open a specially crafted archive and bypass Gatekeeper protection.
24) Improper access control (CVE-ID: CVE-2023-23527)
The vulnerability allows a local application to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in AppleMobileFileIntegrity. A local application can gain access to protected parts of the file system.
25) Out-of-bounds read (CVE-ID: CVE-2023-27949)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in Model I/O. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system or execute arbitrary code
26) Security features bypass (CVE-ID: CVE-2023-23538)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper checks in the PackageKit. A local application can modify protected parts of the file system.
27) Security features bypass (CVE-ID: CVE-2023-23533)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper checks in the Sandbox. A local application can modify protected parts of the file system.
28) Buffer overflow (CVE-ID: CVE-2023-23536)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error when the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
29) Buffer overflow (CVE-ID: CVE-2023-27934)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in dcerpc. A remote attacker can send specially crafted traffic to the system. trigger memory corruption and execute arbitrary code.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
30) Out-of-bounds read (CVE-ID: CVE-2023-27941)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the OS kernel. A local application trigger an out-of-bounds read error and disclose kernel memory.
31) Buffer overflow (CVE-ID: CVE-2023-28181)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreCapture. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
32) Information disclosure (CVE-ID: CVE-2023-28189)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Mail. A local application can gain unauthorized access to sensitive information on the system.
33) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-23537)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Find My feature stores sensitive location information into log files. A local application can read the log files and gain access to sensitive location data.
34) Out-of-bounds write (CVE-ID: CVE-2023-32366)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error in FontParser. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
35) Use-after-free (CVE-ID: CVE-2023-32378)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in IOAcceleratorFamily. A local application can execute arbitrary code with kernel privileges.
36) Out-of-bounds read (CVE-ID: CVE-2023-28199)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the OS kernel. A local application can trigger an out-of-bounds read error and read contents of memory on the system.
37) Integer overflow (CVE-ID: CVE-2023-28185)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the OS kernel. A local application can trigger an integer overflow and crash the kernel.
38) Type confusion (CVE-ID: CVE-2023-41075)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a type confusion error in libpthread. A local application can trigger a type confusion error and execute arbitrary code with kernel privileges.
39) Security features bypass (CVE-ID: CVE-2023-28197)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Messages. A local application can bypass sandbox restrictions and access user-sensitive data.
40) Security features bypass (CVE-ID: CVE-2023-40398)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to improper access restrictions. A sandboxed process may be able to circumvent sandbox restrictions.
Remediation
Install update from vendor's website.