CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 1CVE-2023-32413 – Apple macOS /dev/fd Race Condition Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2023-32413
30 May 2023 — A race condition was addressed with improved state handling. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to gain root privileges. This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability... • https://github.com/synacktiv/CVE-2023-32413 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2023-32419 – Apple Security Advisory 2023-05-18-1
https://notcve.org/view.php?id=CVE-2023-32419
30 May 2023 — The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.5 and iPadOS 16.5. A remote attacker may be able to cause arbitrary code execution. iOS 16.5 and iPadOS 16.5 addresses buffer overflow, bypass, code execution, out of bounds read, and use-after-free vulnerabilities. • https://support.apple.com/en-us/HT213757 •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2023-32420 – Apple Security Advisory 2023-05-18-6
https://notcve.org/view.php?id=CVE-2023-32420
30 May 2023 — An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to cause unexpected system termination or read kernel memory. macOS Ventura 13.4 addresses buffer overflow, bypass, code execution, out of bounds read, out of bounds write, and use-after-free vulnerabilities. • https://support.apple.com/en-us/HT213757 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 1CVE-2023-32422 – Apple Security Advisory 2023-05-18-6
https://notcve.org/view.php?id=CVE-2023-32422
30 May 2023 — This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to bypass Privacy preferences. macOS Ventura 13.4 addresses buffer overflow, bypass, code execution, out of bounds read, out of bounds write, and use-after-free vulnerabilities. • https://github.com/gergelykalman/CVE-2023-32422-a-macOS-TCC-bypass-in-sqlite •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-32423 – Apple Security Advisory 2023-05-18-8
https://notcve.org/view.php?id=CVE-2023-32423
30 May 2023 — A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. macOS Ventura 13.4 addresses buffer overflow, bypass, code execution, out of bounds read, out of bounds write, and use-after-free vulnerabilities. • https://support.apple.com/en-us/HT213757 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-23536
https://notcve.org/view.php?id=CVE-2023-23536
08 May 2023 — The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app may be able to execute arbitrary code with kernel privileges. • https://support.apple.com/en-us/HT213670 •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2022-46720
https://notcve.org/view.php?id=CVE-2022-46720
08 May 2023 — An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to break out of its sandbox • https://support.apple.com/en-us/HT213530 • CWE-190: Integer Overflow or Wraparound •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-32885 – webkitgtk: Memory corruption issue when processing web content
https://notcve.org/view.php?id=CVE-2022-32885
03 May 2023 — A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution A vulnerability was found in WebKitGTK. This security issue occurs when processing maliciously crafted web content that may lead to arbitrary code execution. This memory corruption issue was addressed with improved validation. • https://support.apple.com/en-us/HT213341 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-46703
https://notcve.org/view.php?id=CVE-2022-46703
10 Apr 2023 — A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. An app may be able to read sensitive location information • https://support.apple.com/en-us/HT213530 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-46716
https://notcve.org/view.php?id=CVE-2022-46716
10 Apr 2023 — A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality did not match system settings • https://support.apple.com/en-us/HT213530 •