CVE-2022-22629 — Out-of-bounds Write in Apple Safari

CWE-787 — Out-of-bounds WriteCWE-120 — Classic Buffer Overflow14 documents9 sources
Severity
8.8HIGHNVD
EPSS
21.7%
top 4.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Apple SafariApple TvosApple Watchos+4 more
Timeline
PublishedSep 23
Latest updateApr 6

Description

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages10 packages

▶CVEListV5apple/tvosunspecified — 15.4+1
▶NVDapple/tvos< 15.4
▶NVDapple/macos12.0.0 — 12.3
▶CVEListV5apple/safariunspecified — 15.4
▶NVDapple/ipados< 15.4

🔴Vulnerability Details

3
GHSA
GHSA-pp63-cgj5-h996: A buffer overflow issue was addressed with improved memory handling↗2022-09-25
▶
CVEList
CVE-2022-22629: A buffer overflow issue was addressed with improved memory handling↗2022-09-23
▶
OSV
CVE-2022-22629: A buffer overflow issue was addressed with improved memory handling↗2022-09-23
▶

💥Exploits & PoCs

1
Exploit-DB
TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE)↗2023-04-06
▶

📋Vendor Advisories

9
Ubuntu
WebKitGTK vulnerabilities↗2022-04-28
▶
Red Hat
webkitgtk: Buffer overflow leading to arbitrary code execution↗2022-04-08
▶
Apple
CVE-2022-22629: Safari 15.4↗2022-03-15
▶
Apple
CVE-2022-22629: macOS Monterey 12.3↗2022-03-14
▶
Apple
CVE-2022-22629: iOS 15.4 and iPadOS 15.4↗2022-03-14
▶
CVE-2022-22629 — Out-of-bounds Write in Apple Safari | cvebase