SB2023032762 - Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
Published: March 27, 2023 Updated: July 22, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 53 secuirty vulnerabilities.
1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-27928)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Identity Services stores sensitive information into log files. A local application can read the log files and gain read information about a user’s contacts.
2) Information disclosure (CVE-ID: CVE-2023-27954)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can track sensitive user information.
3) Security features bypass (CVE-ID: CVE-2023-27932)
The vulnerability allows a remote attacker to bypass Same Origin Policy restrictions.
The vulnerability exists due to improper state management. A remote attacker can trick the victim to visit a specially crafted website and bypass Same Origin Policy restrictions.
4) Security features bypass (CVE-ID: CVE-2023-27943)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to improperly implemented security checks within the LaunchServices component, which can result in files downloaded from the internet not having the quarantine flag applied. A remote attacker can trick the victim to download and execute malicious file and compromise the affected system.
5) Memory corruption (CVE-ID: CVE-2023-27933)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local privileged application (with root permissions) can trigger memory corruption and execute arbitrary code with kernel privileges.
6) Use-after-free (CVE-ID: CVE-2023-27969)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with kernel privileges.
7) Out-of-bounds read (CVE-ID: CVE-2023-27929)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in ImageIO. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
8) Out-of-bounds read (CVE-ID: CVE-2023-23535)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in ImageIO. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
9) Security features bypass (CVE-ID: CVE-2023-23526)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists in the iCloud feature. A file from an iCloud shared-by-me folder may be able to bypass Gatekeeper.
10) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-23541)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Accessibility feature stores sensitive information into log files. A local application can read the log files and gain access to sensitive data.
11) Input validation error (CVE-ID: CVE-2023-27961)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in the Calendar application when processing calendar invitation. A remote attacker can exfiltrate user information.
12) Buffer overflow (CVE-ID: CVE-2023-23540)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Apple Neural Engine feature. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
13) Buffer overflow (CVE-ID: CVE-2023-27959)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Apple Neural Engine feature. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
14) Out-of-bounds write (CVE-ID: CVE-2023-27970)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Apple Neural Engine feature. A local application can trigger an out-of-bounds write error and execute arbitrary code with kernel privileges.15) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-23532)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper restrictions management in Apple Neural Engine. A local application can break out of its sandbox.
16) Improper access control (CVE-ID: CVE-2023-23527)
The vulnerability allows a local application to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in AppleMobileFileIntegrity. A local application can gain access to protected parts of the file system.
17) Improper access control (CVE-ID: CVE-2023-27931)
The vulnerability allows a local application to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in AppleMobileFileIntegrity. A local application can gain access to user-sensitive data.
18) Observable discrepancy (CVE-ID: CVE-2023-23543)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists in the Camera app. A local sandboxed application can determine which app is currently using the camera.
19) Integer overflow (CVE-ID: CVE-2023-27937)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in Foundation when handling plist files. A remote attacker can trick the victim to download a malicious app, trigger an integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
20) Buffer overflow (CVE-ID: CVE-2023-23494)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in CarPlay. A remote attacker on the local network can trigger memory corruption and perform a denial of service (DoS) attack.
21) Improper access control (CVE-ID: CVE-2023-27955)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in ColorSync. A local application can bypass implemented security restrictions and read arbitrary files on the system.
22) Out-of-bounds read (CVE-ID: CVE-2023-23528)
The vulnerability allows an attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the Core Bluetooth subsystem. An attacker with physical proximity to device can send specially crafted Bluetooth packet to trigger an out-of-bounds read error and read contents of memory on the system.
23) Buffer overflow (CVE-ID: CVE-2023-28181)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreCapture. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
24) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-23537)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to Find My feature stores sensitive location information into log files. A local application can read the log files and gain access to sensitive location data.
25) Out-of-bounds read (CVE-ID: CVE-2023-27956)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in FontParser. A remote attacker can create a specially crafted image file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
26) Input validation error (CVE-ID: CVE-2023-23525)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in LaunchServices. A local application can execute arbitrary code with root privileges.
27) Improper Authentication (CVE-ID: CVE-2023-28182)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error in the authentication process in NetworkExtension. A remote attacker can spoof a VPN server that is configured with EAP-only authentication on a device.
28) Improper access control (CVE-ID: CVE-2023-23523)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Photos. An attacker with physical access to device can view photos from the Hidden Photos Album without authentication through Visual Lookup.
29) Improper access control (CVE-ID: CVE-2023-27942)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Podcasts. A local application can gain access to user-sensitive data.
30) Input validation error (CVE-ID: CVE-2023-28194)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input in Safari. A remote attacker can trick the victim to visit a malicious website, which can force the application to create a bookmark on the Home Screen.
31) Security features bypass (CVE-ID: CVE-2023-28178)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper input validation in Sandbox component. A local application can bypass Privacy preferences.
32) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-27963)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper permissions checks in Shortcuts. A shortcut may be able to use sensitive data with certain actions without prompting the user.
33) Spoofing attack (CVE-ID: CVE-2022-46705)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of URL in WebKit. A remote attacker can spoof the browser's address bar.
34) Buffer overflow (CVE-ID: CVE-2023-23536)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error when the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
35) Input validation error (CVE-ID: CVE-2023-28201)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit Web Inspector. A remote attacker can trick the victim to visit a specially crafted website and execute arbitrary code on the system.
36) Buffer overflow (CVE-ID: CVE-2023-32435)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
37) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-46724)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in Magnifier. An attacker with physical access to device can view the last image used in Magnifier from the lock screen.
38) Spoofing attack (CVE-ID: CVE-2022-46725)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of URL in WebKit. A remote attacker can trick the victim to visit a specially crafted web page and spoof the address bar.
39) Use-after-free (CVE-ID: CVE-2023-28198)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim to open a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
40) Type Confusion (CVE-ID: CVE-2023-32358)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in WebKit PDF. A remote attacker can trick the victim to open a specially crafted PDF file, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
41) Buffer overflow (CVE-ID: CVE-2023-32424)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
42) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-42830)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to App Store includes sensitive information into log files. A local application can access sensitive location information.43) Integer overflow (CVE-ID: CVE-2023-28185)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the OS kernel. A local application can trigger an integer overflow and crash the kernel.
44) Out-of-bounds write (CVE-ID: CVE-2023-32366)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error in FontParser. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
45) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-28195)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to the Find My feature stores sensitive information into log files. A local application can read sensitive location information.
46) State Issues (CVE-ID: CVE-2023-28187)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a state issue within the OS kernel. A local user can perform a denial of service (DoS) attack.
47) Input validation error (CVE-ID: CVE-2023-28188)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in TextKit. A remote attacker can perform a denial of service (DoS) attack.
48) Security features bypass (CVE-ID: CVE-2023-32370)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error in WebKit, as Content Security Policy may fail to block domains with wildcards. A remote attacker can bypass implemented CSP restrictions.
49) Out-of-bounds read (CVE-ID: CVE-2023-42862)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in ImageIO. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
50) Out-of-bounds read (CVE-ID: CVE-2023-42865)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in ImageIO. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
51) Type confusion (CVE-ID: CVE-2023-41075)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a type confusion error in libpthread. A local application can trigger a type confusion error and execute arbitrary code with kernel privileges.
52) Use-after-free (CVE-ID: CVE-2014-1745)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing vectors that trigger removal of an SVGFontFaceElement object, related to core/svg/SVGFontFaceElement.cpp. A remote attackers can cause a denial of service or possibly have unspecified other impact.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
53) Security features bypass (CVE-ID: CVE-2023-40398)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to improper access restrictions. A sandboxed process may be able to circumvent sandbox restrictions.
Remediation
Install update from vendor's website.