CVE-2023-27946

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution...

CVE-2023-23494

CVE-2023-23494 affects Apple iOS and iPadOS 16.4 releases. The issue is described as a buffer overflow that was addressed by improved bounds checking, with the fix available in iOS 16.4 and iPadOS 16.4. The documented impact is that a user in a privileged network position may cause a denial-of-se...

CVE-2023-27959

CVE-2023-27959 affects Apple iOS and iPadOS kernels. The vulnerability could allow an app to execute arbitrary code with kernel privileges due to memory handling issues. Apple’s advisories confirm the fix is implemented in iOS 16.4 and iPadOS 16.4. Affected component: Apple Neural Engine entries ...

CVE-2023-23527

CVE-2023-23527 is an Apple OS vulnerability addressed by updates across multiple platforms. The issue allows a user to gain access to protected parts of the file system and is mitigated by patches in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, iOS 16.4, iPadOS 16.4, tvOS 16.4...

CVE-2023-28182

CVE-2023-28182 affects Apple devices where VPN servers configured with EAP-only authentication may be spoofed by a user in a privileged network position. The root issue is authentication weakness that could allow impersonation of a VPN server. Impact, as stated, is limited to integrity concerns f...

CVE-2022-46720

CVE-2022-46720 affects Apple platforms (iOS 16.2, iPadOS 16.2, macOS Ventura 13.1). Root cause: integer overflow mitigated by improved input validation in dyld, with the issue described as allowing an app to break out of its sandbox. Impact: sandbox escape if exploited. Exploitation details are n...

CVE-2023-28181

CVE-2023-28181 affects Apple platforms (notably CoreCapture and Kernel-related components) with a memory handling flaw that could allow an app to execute arbitrary code with kernel privileges. The issue is fixed in macOS Ventura 13.3, iOS 16.4 / iPadOS 16.4, iOS 15.7.6 / iPadOS 15.7.6, macOS Mont...

CVE-2023-23543

CVE-2023-23543 affects Apple platforms (macOS Ventura 13.3; iOS 15.7.4/iPadOS 15.7.4; iOS 16.4/iPadOS 16.4; watchOS 9.4). A sandboxed app may be able to determine which other app is currently using the camera due to restricted observability of app states. Root cause: privacy-related observability...

CVE-2023-27956

The CVE-2023-27956 issue concerns the FontParser component on Apple platforms. It describes a memory handling flaw that, when processing a maliciously crafted image, could disclose process memory. Affected products/versions include macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPad...

CVE-2023-23526

CVE-2023-23526 involves Gatekeeper bypass via a file downloaded from an iCloud Shared by Me folder. The issue arises from insufficient checks in Gatekeeper, allowing a file from that folder to bypass the gatekeeping checks. Apple fixed this by addressing the vulnerability with additional checks, ...

CVE-2023-27954

CVE-2023-27954 affects WebKitGTK/WebKit2GTK (WebKitGTK/WebKit2GTK family). The publicly cited description indicates that a website may be able to track sensitive user information. Debian LTS and Debian security advisories list CVE-2023-27954 among fixed issues for webkit2gtk, with fixed versions ...

CVE-2023-27969

CVE-2023-27969 is a use-after-free kernel vulnerability in Apple platforms. The issue could allow an app to execute arbitrary code with kernel privileges via a local attack, fixed in macOS Ventura 13.3, iOS 16.4 / iPadOS 16.4, and iOS 15.7.4 / iPadOS 15.7.4, as well as tvOS 16.4 and watchOS 9.4. ...

CVE-2023-27928

The CVE-2023-27928 vulnerability concerns a privacy issue where private data redaction for log entries was insufficient, potentially allowing an app to access information about a user’s contacts. Affected products and versions include: macOS Big Sur 11.7.5; macOS Ventura 13.3; iOS 15.7.4 and iOS ...

CVE-2023-27954

The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information...

CVE-2023-28201

This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4. A remote user may be able to cause unexpected app termination or arbitrary code execution...

CVE-2023-27954

The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information...

CVE-2023-28182

The issue was addressed with improved authentication. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A user in a privileged network position may be able to spoof a VPN server that is configured with...

CVE-2023-27943

This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Files downloaded from the internet may not have the quarantine flag applied...

CVE-2023-23541

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16.4. An app may be able to access information about a user’s contacts...

CVE-2023-27961

CVE-2023-27961 corresponds to multiple input-validation issues that affect Apple calendar invite handling across macOS, iOS, iPadOS, watchOS, and macOS Big Sur/Monterey/Ventura lineages. The fixed versions are macOS Ventura 13.3; macOS Monterey 12.6.4; macOS Big Sur 11.7.5; iOS/iPadOS 16.4 and 15...