CVE-2023-32392

The CVE-2023-32392 entry concerns a privacy issue where private location data could be exposed via log entry redaction. Apple fixed the flaw in multiple platforms: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5, and iPadOS 16.5. The underlying im...

CVE-2023-32352

CVE-2023-32352 is a logic issue in Apple's Gatekeeper checks that may allow an app to bypass Gatekeeper verification. The issue is fixed in: watchOS 9.5; macOS Ventura 13.4; macOS Big Sur 11.7.7; macOS Monterey 12.6.6; iOS 16.5; iPadOS 16.5. No exploitation status is provided in the supplied docu...

CVE-2023-32407

CVE-2023-32407 describes a logic issue in Apple platforms that could allow an app to bypass Privacy preferences. Affected components are not explicitly enumerated in the provided documents, but constants indicate multiple Apple OSes are impacted (watchOS, tvOS, macOS, iOS, iPadOS) with versions l...

CVE-2023-32412

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to cause unexpected app...

CVE-2023-27930

CVE-2023-27930 is a kernel-level type confusion vulnerability addressed by Apple in iOS 16.5 / iPadOS 16.5, watchOS 9.5, tvOS 16.5, and macOS Ventura 13.4. The issue allows an app to potentially execute arbitrary code with kernel privileges due to a type confusion in the kernel; Apple notes impro...

CVE-2023-32354

CVE-2023-32354 is an Apple vulnerability described as an out-of-bounds read that could allow an app to disclose kernel memory. The public descriptions tie this issue to Apple OS updates: watchOS 9.5, tvOS 16.5, iOS 16.5, and iPadOS 16.5. The fixed condition is “improved input validation” (per mul...

CVE-2023-32407

A logic issue was addressed with improved state management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to bypass Privacy preferences...

CVE-2023-32417

This CVE (CVE-2023-32417) affects Apple Watch on watchOS prior to 9.5 and is resolved in watchOS 9.5. Description and Apple security content confirm that a user with physical access to a locked Apple Watch could view photos or contacts via accessibility features. The root issue is described as re...

CVE-2023-32409

The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issu...

CVE-2023-32398

CVE-2023-32398 is a use-after-free memory bug that could allow an app to execute arbitrary code with kernel privileges. It is fixed in multiple Apple OS updates: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6/iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, and iOS 16.5/iPadOS ...

CVE-2023-28202

CVE-2023-28202 relates to Apple systems where a firewall setting may fail to take effect after exiting Settings due to a state-management flaw. Affected products include iOS/iPadOS 16.x, watchOS 9.x, tvOS 16.x, and macOS Ventura 13.x. The issue is described as a state-management fix and is noted ...

CVE-2023-32420

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to cause unexpected system termination or read kernel memory...

CVE-2023-32409

The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issu...

CVE-2023-32434

CVE-2023-32434 is an Apple kernel vulnerability in the XNU VM layer causing an integer overflow that could allow an app to execute code with kernel privileges. Public documentation confirms fixed in multiple OS versions (watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 / iPadOS 15.7.7, macOS Monte...

CVE-2023-32403

This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to read sensitive location...

CVE-2023-32372

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. Processing an image may result in disclosure of process memory...

CVE-2023-32373

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is...

CVE-2023-32390

The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, macOS Ventura 13.4. Photos belonging to the Hidden Photos Album could be viewed without authentication through Visual Lookup...

CVE-2023-28204

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that th...

CVE-2023-32408

CVE-2023-32408 is an Apple vulnerability where an app may read sensitive location information due to improved handling of caches. Affected: watchOS 9.5; tvOS 16.5; macOS Ventura 13.4; macOS Monterey 12.6.6; iOS 15.7.6 and 16.5; iPadOS 15.7.6 and 16.5. Root cause: improper cache handling leading t...