CVE-2023-27954

The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information...

CVE-2023-23541

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16.4. An app may be able to access information about a user’s contacts...

CVE-2023-23532

This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.6 and iPadOS 15.7.6. An app may be able to break out of its sandbox...

CVE-2023-28182

The issue was addressed with improved authentication. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A user in a privileged network position may be able to spoof a VPN server that is configured with...

CVE-2023-28201

This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4. A remote user may be able to cause unexpected app termination or arbitrary code execution...

CVE-2023-27943

This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Files downloaded from the internet may not have the quarantine flag applied...

CVE-2023-28178

CVE-2023-28178 is a logic-issue vulnerability in Apple platforms where an app may bypass Privacy preferences due to insufficient validation. The issue is addressed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Monterey 12.6.4, tvOS 16.4, and watchOS 9.4. The CVSS-like metrics indicate Lo...

CVE-2023-28201

This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4. A remote user may be able to cause unexpected app termination or arbitrary code execution...

CVE-2022-32885

CVE-2022-32885 is a WebKitGTK/WebKit memory corruption issue triggered by processing malicious web content. The connected advisories confirm the root cause as memory corruption from handling web content and show affected/patch targets across platforms: Apple devices (iOS 15.6, iPadOS 15.6, macOS ...

CVE-2023-27946

CVE-2023-27946 describes an out-of-bounds read fixed by Apple in macOS Ventura 13.3, iOS 15.7.4, iPadOS 15.7.4, macOS Monterey 12.6.4, and macOS Big Sur 11.7.5. The issue could cause unexpected termination or arbitrary code execution when processing a maliciously crafted file. Affected components...

CVE-2023-28200

CVE-2023-28200 is a validation issue fixed by Apple in macOS Ventura 13.3, iOS 15.7.4, iPadOS 15.7.4, macOS Monterey 12.6.4 and macOS Big Sur 11.7.5. The vulnerability stems from insufficient input sanitization in a kernel-related validation path, allowing an app to disclose kernel memory. Exploi...

CVE-2023-27961

CVE-2023-27961 corresponds to multiple input-validation issues that affect Apple calendar invite handling across macOS, iOS, iPadOS, watchOS, and macOS Big Sur/Monterey/Ventura lineages. The fixed versions are macOS Ventura 13.3; macOS Monterey 12.6.4; macOS Big Sur 11.7.5; iOS/iPadOS 16.4 and 15...

CVE-2023-23536

The CVE-2023-23536 issue is an Apple kernel privilege escalation fixed by improved bounds checks. Affected products include macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5, iOS 16.4 and 15.7.4/iPadOS 16.4 and 15.7.4, tvOS 16.4, and watchOS 9.4. It can allow an app to execute arbit...

CVE-2023-23494

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 16.4 and iPadOS 16.4. A user in a privileged network position may be able to cause a denial-of-service...

CVE-2023-27943

This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Files downloaded from the internet may not have the quarantine flag applied...

CVE-2023-23528

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 16.4, iOS 16.4 and iPadOS 16.4. Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory...

CVE-2023-27941

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to disclose kernel memory...

CVE-2022-32885

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution...

Apple releases first Rapid Security Response update for iOS, iPadOS, and macOS users

On Monday, Apple released its first batch of Rapid Security Response RSR patches, iOS 16.4.1 a, iPadOS 16.4.1 a, and macOS 13.3.1 a, for iPhone and iPad, and macOS devices, respectively. RSR is a new type of software patch delivered between Apple's regular, scheduled software updates. Previously,...

The Bug Report – April 2023 Edition

The Bug Report – April 2023 Edition By Trellix · May 03, 2023 This story was also written by John Rodriguez. It’s never easy coming back. Why am I here? Seems as if some of us should have stayed at our tropical vacation getaway. Nothing like coming back to the cyber world screeching about...