CVE-2022-42851

The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2. Parsing a maliciously crafted TIFF file may lead to disclosure of user information...

CVE-2022-42866

The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to read sensitive location information...

CVE-2022-46693

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing a maliciously crafted file may lead to arbitrary code execution...

CVE-2022-42863

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2022-46696

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2022-42861

This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2. An app may be able to break out of its sandbox...

CVE-2022-46693

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing a maliciously crafted file may lead to arbitrary code execution...

CVE-2022-42846

The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2. Parsing a maliciously crafted video file may lead to unexpected system termination...

CVE-2022-42856

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this iss...

CVE-2022-46700

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2022-42866

The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to read sensitive location information...

CVE-2022-32943

The CVE-2022-32943 issue affects Apple’s Photos component and is addressed in iOS 16.2 and iPadOS 16.2, and macOS Ventura 13.1. The root cause is described as an issue addressed with improved bounds checks, preventingShake-to-undo from resurfacing a deleted photo without authentication. In the pu...

CVE-2022-42864

CVE-2022-42864 describes a race condition in Apple's IOHID kernel path (IOHIDDevice::postElementTransaction) where element data may be read from shared memory while being validated, allowing out-of-bounds reads and writes on kernel heap. Exploitation details circulated in public proof-of-concept ...

CVE-2022-42867

CVE-2022-42867 is a use-after-free in WebKit/WebKitGTK (WebKitGTK). The root cause is a memory management issue that, when processing malicious web content, could lead to arbitrary code execution. The advisory notes this is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2, iPadOS 16....

CVE-2022-42852

The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory...

CVE-2022-42856

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this iss...

CVE-2022-46691

CVE-2022-46691 is a memory consumption issue in WebKitGTK / WebKit that may enable arbitrary code execution when processing malicious web content. Connected advisories confirm the issue affects WebKitGTK/WebKit, with fixes delivered in Safari 16.2 and corresponding WebKitGTK updates. The underlyi...

CVE-2022-32860

CVE-2022-32860 is a local kernel‑level vulnerability described as an out‑of‑bounds write caused by improved input validation. Root cause: a faulty input path allows arbitrary code execution with kernel privileges. Affected platforms/versions per the sources: iOS 15.6, iPadOS 15.6, macOS Monterey ...

CVE-2022-46689

CVE-2022-46689 is a local privilege-escalation race condition in Apple's XNU kernel related to copy-on-write handling. Public sources describe PoCs/exploits (e.g., MacDirtyCow family) that could enable an app to execute arbitrary code with kernel privileges by exploiting a race window in COW oper...

CVE-2022-42848

CVE-2022-42848 affects Apple platforms (iOS, iPadOS, tvOS) with a logic flaw that could allow an app to execute arbitrary code with kernel privileges. The issue is mitigated by updates: fixed in iOS 16.2 and iPadOS 16.2, and iOS 15.7.2 / iPadOS 15.7.2, plus tvOS 16.2. No exploit details are provi...