Authentication flaw

An authentication issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4. A person with physical access to an iOS device may be able to access photos from the lock screen...

CVE-2022-22670

An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, watchOS 8.5. A malicious application may be able to identify what other applications a user has installed...

CVE-2022-22659

A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4. An attacker in a privileged network position may be able to leak sensitive user information...

CVE-2022-22659

CVE-2022-22659 – Apple iOS/iPadOS NetworkExtension information disclosure Affected products: iPhone and iPad running iOS/iPadOS. The vulnerability is described as a logic issue in NetworkExtension causing potential leakage of sensitive user information when the device is in a privileged network p...

CVE-2022-22670

CVE-2022-22670 in Apple's MediaRemote module affects tvOS 15.4, iOS 15.4, iPadOS 15.4, and watchOS 8.5. The issue is described as an access control restriction problem that could allow a malicious app to identify which other applications a user has installed. Public details in the connected docs ...

CVE-2022-22667

CVE-2022-22667 (Apple GPU Drivers) is a use-after-free memory corruption issue that could allow arbitrary code execution with kernel privileges. The vulnerability is fixed in iOS 15.4 / iPadOS 15.4; exploitation requires authenticated access. Affected component: GPU Drivers. Remediation: update t...

CVE-2022-22667

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.4 and iPadOS 15.4. An application may be able to execute arbitrary code with kernel privileges...

CVE-2022-22671

CVE-2022-22671 concerns an authentication issue in iOS/iPadOS where a person with physical access could view photos from the lock screen. The connected sources confirm the vulnerability affects Apple devices and is fixed in iOS 15.4 / iPadOS 15.4. Affected component: VoiceOver/lock-screen handlin...

CVE-2022-22666

CVE-2022-22666 is a memory corruption vulnerability affecting AppleAVD in Apple’s media decoding stack. The issue arises when processing a maliciously crafted image, due to a memory corruption condition that can lead to heap corruption. Public details indicate the vulnerability is addressed by va...

CVE-2022-22653

CVE-2022-22653 corresponds to a logic issue in iOS/iPadOS that could allow a malicious website to access information about the user and their devices. The NVD/NIST entry notes the fix in iOS 15.4 and iPadOS 15.4, with CVSS v3.1 base score 7.5 (Network, High impact on confidentiality; no impact on...

CVE-2022-22653

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4. A malicious website may be able to access information about the user and their devices...

CVE-2022-22642

This issue was addressed with improved checks. This issue is fixed in iOS 15.4 and iPadOS 15.4. A user may be able to bypass the Emergency SOS passcode prompt...

CVE-2022-22642

CVE-2022-22642 affects FaceTime on Apple iOS/iPadOS. The vulnerability could allow a user to bypass the Emergency SOS passcode prompt. Apple fixed the issue in iOS 15.4 and iPadOS 15.4, addressing the bypass through enhanced checks/validation. The available connected documents consistently descri...

CVE-2022-22652

CVE-2022-22652 affects Apple's iOS/iPadOS where the GSMA authentication panel could be shown on the lock screen, enabling a physically proximate user to view or modify carrier account information. The issue was mitigated by requiring device unlock to interact with the GSMA panel and is fixed in i...

CVE-2022-22638

A null pointer dereference was addressed with improved validation. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Big Sur 11.6.5, Security Update 2022-003 Catalina, watchOS 8.5, macOS Monterey 12.3. An attacker in a privileged position may be able to perform a denial of service...

CVE-2022-22640

CVE-2022-22640 is a memory corruption in Apple’s kernel that was mitigated by improved validation. The vulnerability is fixed in tvOS 15.4, iOS 15.4/iPadOS 15.4, macOS Monterey 12.3, and watchOS 8.5. The affected component is the Kernel, with the explicit impact described as arbitrary code execut...

CVE-2022-22641

CVE-2022-22641 is a use-after-free issue resolved by memory management fixes in Apple OS updates. It affects tvOS 15.4, iOS 15.4, iPadOS 15.4, and macOS Monterey 12.3, where an app may gain elevated privileges. Remediation per provided documents: update systems to the listed fixed versions (tvOS ...

CVE-2022-22641

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. An application may be able to gain elevated privileges...

CVE-2022-22633

CVE-2022-22633 is a memory corruption vulnerability in Apple’s Accelerate Framework that can be triggered by opening a maliciously crafted PDF, potentially leading to arbitrary code execution. It is fixed in watchOS 8.5, iOS 15.4 / iPadOS 15.4, macOS Big Sur 11.6.5, and macOS Monterey 12.3. Publi...

CVE-2022-22639

A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. An application may be able to gain elevated privileges...