SB2023072445 - Multiple vulnerabilities in Apple macOS Monterey
Published: July 24, 2023 Updated: July 26, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 50 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2023-32441)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
2) Out-of-bounds read (CVE-ID: CVE-2023-32443)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in sips. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
3) Improper access control (CVE-ID: CVE-2023-32442)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper access restrictions in Shortcuts. A local application can modify sensitive Shortcuts app settings.
4) Security features bypass (CVE-ID: CVE-2023-38602)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to an error in PackageKit. A local application can modify protected parts of the file system.
5) Information disclosure (CVE-ID: CVE-2023-38259)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a logic error in PackageKit. A local application can gain unauthorized access to sensitive information.
6) NULL pointer dereference (CVE-ID: CVE-2023-2953)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the ber_memalloc_x() function. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.
7) Out-of-bounds read (CVE-ID: CVE-2023-38258)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing 3D models in Model I/O. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
8) Out-of-bounds read (CVE-ID: CVE-2023-38421)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing 3D models in Model I/O. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
9) Input validation error (CVE-ID: CVE-2023-38593)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a logic issue in libxpc. A local application can perform a denial of service (DoS) attack.
10) Untrusted search path (CVE-ID: CVE-2023-38565)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to usage of an untrusted search path in libxpc. A local application can execute arbitrary code with root privileges.
11) Buffer overflow (CVE-ID: CVE-2023-38606)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
12) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-35983)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Assets. A local application can modify protected parts of the file system.
13) Use-after-free (CVE-ID: CVE-2023-35993)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.
14) Use-after-free (CVE-ID: CVE-2023-32433)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.
15) Use-after-free (CVE-ID: CVE-2023-32381)
The vulnerability allows a local application to escalate privileges on the system.
16) Input validation error (CVE-ID: CVE-2023-32418)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in Grapher. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.
17) Input validation error (CVE-ID: CVE-2023-36854)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in Grapher. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.
18) Information disclosure (CVE-ID: CVE-2023-32416)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in the Find My feature. A local application can read sensitive location information.
19) Expected behavior violation (CVE-ID: CVE-2023-28322)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.
20) Improper certificate validation (CVE-ID: CVE-2023-28321)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to improper certificate validation when matching wildcards in TLS certificates for IDN names. A remote attacker crate a specially crafted certificate that will be considered trusted by the library.
Successful exploitation of the vulnerability requires that curl is built to use OpenSSL, Schannel or Gskit.
21) Improper synchronization (CVE-ID: CVE-2023-28320)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper synchronization when resolving host names using the alarm() and siglongjmp() function. A remote attacker can force the application to crash by influencing contents of the global buffer.
22) Use-after-free (CVE-ID: CVE-2023-28319)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a use-after-free error when checking the SSH sha256 fingerprint. A remote attacker can use the application to connect to a malicious SSH server, trigger a use-after-free error and gain access to potentially sensitive information.
Successful exploitation of the vulnerability requires usage of the the CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 option, and also CURLOPT_VERBOSE or CURLOPT_ERRORBUFFER options have to be set.
23) Security features bypass (CVE-ID: CVE-2023-32364)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to a logic error in AppSandbox. A local application can bypass sandbox restrictions.
24) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32429)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper restriction checks in SystemMigration. A local application can bypass Privacy preferences.
25) Security features bypass (CVE-ID: CVE-2023-32444)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to a logic error in NSSpellChecker. A local application can bypass sandbox restrictions.
26) Use-after-free (CVE-ID: CVE-2023-34241)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in cupsdAcceptClient(). A remote attacker can cause a denial of service condition on the target system.
27) Buffer overflow (CVE-ID: CVE-2023-34425)
The vulnerability allows a local application to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can trigger memory corruption and execute arbitrary code with kernel privileges.
28) Integer overflow (CVE-ID: CVE-2023-36495)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to integer overflow within the OS kernel. A local application can trigger an integer overflow and execute arbitrary code with kernel privileges.
29) Out-of-bounds read (CVE-ID: CVE-2023-37285)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary condition within the OS kernel. A local application can trigger an out-of-bounds read error and execute arbitrary code with kernel privileges.
30) UNIX symbolic link following (CVE-ID: CVE-2023-38571)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to a symlink following issue within the Music component. A local application can create a specially crafted symbolic link to a critical file on the system and bypass Privacy preferences.
31) Buffer overflow (CVE-ID: CVE-2023-38590)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the OS kernel. A remote attacker can send specially crafted data to the system, trigger memory corruption and crash the kernel.
32) Use-after-free (CVE-ID: CVE-2023-38598)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the OS kernel. A local application can trigger a use-after-free error and execute arbitrary code with kernel privileges.
33) Security features bypass (CVE-ID: CVE-2023-38601)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to improper access restrictions within the Net-SNMP component. A local application can modify protected parts of the file system.
34) Input validation error (CVE-ID: CVE-2023-38603)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in OS kernel. A remote attacker can send specially crafted input to the system and perform a denial of service (DoS) attack.
35) Out-of-bounds write (CVE-ID: CVE-2023-38604)
The vulnerability allows a local application to escalate privileges on the system.
36) Cryptographic issues (CVE-ID: CVE-2023-40440)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a state error within the Mail subsystem. The S/MIME encrypted email messages can be inadvertently sent unencrypted.
37) Information disclosure (CVE-ID: CVE-2023-40442)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the Accessibility component. A local application can read sensitive location information.
38) Buffer overflow (CVE-ID: CVE-2023-29491)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing malformed data in a terminfo database file. A local user can trigger memory corruption and execute arbitrary code on the target system.
39) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-32422)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to SQLite stores sensitive information into log files. A local application can access data from other apps by enabling additional SQLite logging.
40) Information disclosure (CVE-ID: CVE-2023-38605)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the Weather application. A local application can determine a user’s current location.
41) Information disclosure (CVE-ID: CVE-2023-40392)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the CFNetwork. A local application can read sensitive location information.
42) Buffer overflow (CVE-ID: CVE-2023-41990)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in FontParser. A remote attacker can trick the victim to open a specially crafted file or visit a malicious website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
43) Heap-based buffer overflow (CVE-ID: CVE-2023-1916)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the extractImageSection() function in tools/tiffcrop.c. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.
44) State Issues (CVE-ID: CVE-2023-42829)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state issue in OpenSSH implementation. A local application can access SSH passphrases.
45) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-42831)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper security restrictions within the Security component. A local application can fingerprint the user.
46) Race condition (CVE-ID: CVE-2023-42832)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a race condition within the Software Update feature. A local application can exploit the race and execute arbitrary code with root privileges.
47) Out-of-bounds write (CVE-ID: CVE-2023-1801)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the SMB protocol decoder. A remote attacker can send specially crafted over the network, trigger an out-of-bounds write and crash the application.
48) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2023-2426)
The vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to an out-of-range pointer offset within the mb_charlen() function in mbyte.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.
49) NULL pointer dereference (CVE-ID: CVE-2023-2609)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the get_register() function in register.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.
50) Integer overflow (CVE-ID: CVE-2023-2610)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the regtilde() function in regexp.c. A remote attacker can trick the victim to open a specially crafted file, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.