Apple Releases Security Updates for iOS and macOS

Apple has released security updates to address a vulnerability in multiple products. A cyber threat actor could exploit this vulnerability to take control of an affected device. CISA encourages users and administrators to review the following advisories and apply the necessary updates. iOS 15.7.9...

The vulnerability of the Model I/O framework in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Model I/O framework in macOS operating systems is related to the disclosure of information. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

UBUNTU-CVE-2023-36671

An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel even if this traffic is not generated by the VPN client. Thi...

UBUNTU-CVE-2023-36673

An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel, even if this traffic is not generated by the VPN client, while...

The vulnerability of the Grapher component in macOS operating systems allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the Grapher component in macOS operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause service failures...

The vulnerability of the PackageKit component in the macOS operating system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of PackageKit component in the macOS operating system is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Clario VPN client security vulnerability

Clario VPN client is a VPN client for Mac from Clario. A security vulnerability exists in Clario VPN client macOS version 5.9.1.1662, which originates when the VPN client insecurely configures the operating system so that all IP traffic that gets to the VPN server's IP address is sent outside the...

PT-2023-26413 · F5 · Big-Ip Edge Client Installer

Name of the Vulnerable Software and Affected Versions: BIG-IP Edge Client Installer affected versions not specified Description: The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Recommendations: At the moment, there...

PT-2023-4211 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.7.9 macOS versions prior to 12.6.8 macOS versions prior to 13.5 Description: A logic issue was addressed with improved restrictions, which may allow an app to access user-sensitive data. The issue is related to the...

PT-2023-4224 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.5 Description: The issue is related to insufficient access control in a component of the macOS operating system, which may allow an attacker to gain unauthorized access to protected information. An app may be able t...

CVE-2023-32395

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to modify protected parts of the file system...

PT-2023-3373 · Cisco · Cisco Duo Two-Factor Authentication For Macos

Name of the Vulnerable Software and Affected Versions: Cisco Duo Two-Factor Authentication for macOS affected versions not specified Description: A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and...

CVE-2023-28600

Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client...

(Pwn2Own) Apple macOS /dev/fd Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the /dev/fd filesystem...

CVE-2023-0976

A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ folder. The malicious file is executed by running the TA deployment feature located in the System Tree...

CVE-2023-27529

Wacom Tablet Driver installer prior to 6.4.2-1 for macOS contains an improper link resolution before file access vulnerability. When a user is tricked to execute a small malicious script before executing the affected version of the installer, arbitrary code may be executed with the root privilege...

CVE-2023-0834

Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce Access: from 6.12 before 8.1...

CVE-2022-48481

In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible...

PT-2023-21592 · Qualys +1 · Qualys Cloud Agent +1

Name of the Vulnerable Software and Affected Versions: Qualys Cloud Agent for macOS versions 2.5.1-75 through 3.7 Description: The Qualys Cloud Agent for macOS installer allows a local escalation of privilege, bounded only to the time of installation and only on older macOSX versions macOS 10.15...

PT-2023-21614 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: A denial-of-service issue was addressed with improved memory handling. A user in a privileged network position may be able to cause a denial-of-service. Recommendations: For versions prior to 13.3,...