CVE-2022-22588

CVE-2022-22588 affects Apple’s HomeKit framework. The issue is a resource-exhaustion (DoS) caused by processing maliciously crafted HomeKit accessory names, with remediation in iOS 15.2.1 and iPadOS 15.2.1. Affects HomeKit components, exploited via long-named devices or invitations, leading to cr...

CVE-2022-22584

CVE-2022-22584 is a memory corruption vulnerability in Apple software where improved validation addresses the issue. The flaw could allow arbitrary code execution when processing a maliciously crafted file. Fixed in the following official updates: tvOS 15.3, iOS 15.3, iPadOS 15.3, watchOS 8.4, an...

CVE-2022-22587

CVE-2022-22587 is an Apple IOMobileFrameBuffer memory corruption vulnerability that could allow code execution with kernel privileges. The issue is cited as fixed in iOS 15.3, iPadOS 15.3, macOS Big Sur 11.6.3, and macOS Monterey 12.2. Apple’s advisory notes a report that it may have been activel...

CVE-2022-22587

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may...

CVE-2022-22585

An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access a user's files...

CVE-2022-22585

CVE-2022-22585 affects Apple platforms via a path validation/symlink handling issue. The root cause is inadequate path sanitization, allowing an application to access a user’s files. The vulnerability is fixed in iOS 15.3, iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, and macOS Big Su...

CVE-2022-22579

CVE-2022-22579 is an information-disclosure vulnerability in Apple macOS components (Model I/O) caused by improper state management. Publicly referenced in macOS advisories HT213054 (macOS 12.x before 12.2) and HT213055 (macOS 11.x before 11.6.3), with fixed updates described as Security Update 2...

CVE-2022-22578

A logic issue was addressed with improved validation. This issue is fixed in tvOS 15.3, iOS 15.3 and iPadOS 15.3, watchOS 8.4, macOS Monterey 12.2. A malicious application may be able to gain root privileges...

CVE-2021-30771

The CVE-2021-30771 entry affects Apple’s FontParser component (macOS Big Sur 11.4, iOS 14.6/iPadOS 14.6, watchOS 7.5, tvOS 14.6). It is caused by an out-of-bounds write when processing a maliciously crafted font file, with the impact described as arbitrary code execution. Apple’s advisory indicat...

CVE-2021-30771

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4, iOS 14.6 and iPadOS 14.6, watchOS 7.5, tvOS 14.6. Processing a maliciously crafted font file may lead to arbitrary code execution...

Exploit for Race Condition in Apple Ipados

Pentagram-exploit-tester A test app to check if your device is...

CVE-2022-22643

CVE-2022-22643 concerns FaceTime on Apple devices. Description: A user may send audio and video in a FaceTime call without knowing that they have done so. Connected docs confirm affected platforms (iOS/iPadOS/macOS) and state the issue was fixed in iOS 15.4, iPadOS 15.4, and macOS Monterey 12.3 t...

CVE-2022-22643

This issue was addressed with improved checks. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. A user may send audio and video in a FaceTime call without knowing that they have done so...

CVE-2022-22620

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 v. 16612.4.9.1.8 and 15612.4.9.1.8. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a...

Apple iOS, iPadOS, and macOS Monterey Permissions Licensing and Access Control Issues Vulnerability

Apple iOS and Apple iPadOS are products of Apple, Inc. Apple iOS is an operating system developed for mobile devices. The vulnerability stems from the fact that FaceTime does not properly restrict access to resources from unauthorized roles, and can be exploited by an attacker with physical acces...

Apple iOS and Apple iPadOS Post-release Reuse Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices and Apple iPadOS is an operating system for iPad tablets. This vulnerability can be exploited to cause arbitrary code execution...

Buffer Overflow Vulnerability in Multiple Apple Products (CNVD-2022-23007)

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, Apple iPadOS is an operating system for iPad tablets, and Apple watchOS is a smartwatch operating system. A buffer overflow vulnerability exists in several Apple products. The...

Multiple Apple Products Out-of-Bounds Reading Vulnerability (CNVD-2022-23002)

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system for mobile devices, Apple iPadOS is an operating system for iPad tablets, Apple watchOS is an operating system for smartwatches, and Apple tvOS is an operating system for smartphones. Apple tvOS is a smart TV...

Apple iOS and Apple iPadOS Input Validation Error Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices and Apple iPadOS is an operating system for iPad tablets. Apple iOS and Apple iPadOS are vulnerable to an input validation error, which stems from The vulnerability is caused b...

Multiple Apple products release post-reuse vulnerabilities

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices, Apple iPadOS is an operating system for iPad tablets, and Apple tvOS is a smart TV operating system from Apple Inc. A number of Apple products are vulnerable to a post-release...