macOS 15.x < 15.8.3 Multiple Vulnerabilities (149720)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(377979);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/11");

  script_cve_id(
    "CVE-2026-111497",
    "CVE-2026-113960",
    "CVE-2026-113961",
    "CVE-2026-113964",
    "CVE-2026-113965",
    "CVE-2026-113968",
    "CVE-2026-113969",
    "CVE-2026-113970"
  );
  script_xref(name:"APPLE-SA", value:"149720");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/11/10");

  script_name(english:"macOS 15.x < 15.8.3 Multiple Vulnerabilities (149720)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a macOS update that fixes multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.8.3. It is, therefore, affected by
multiple vulnerabilities:

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3
    through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state
    memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary
    code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries
    between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. (CVE-2026-111497)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS
    26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3,
    visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent
    before they joined. (CVE-2026-113960)

  - An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and
    iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe
    26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and
    receive its messages. (CVE-2026-113961)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS
    18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS
    Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in
    Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device
    without user interaction. (CVE-2026-113964)

  - This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS
    26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3,
    macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be
    able to establish a pairing without user interaction. (CVE-2026-113965)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported
version number.");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/149720");
  script_set_attribute(attribute:"solution", value:
"Upgrade to macOS 15.8.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-111497");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x:15.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos:15.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_ports("Host/MacOSX/Version", "Host/local_checks_enabled", "Host/MacOSX/packages/boms");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_apple.inc');

var app_info = vcf::apple::macos::get_app_info();

var constraints = [
  { 'fixed_version' : '15.8.3', 'min_version' : '15.0', 'fixed_display' : 'macOS Sequoia 15.8.3' }
];

vcf::apple::macos::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);