CVE-2023-27937 — Integer Overflow or Wraparound in Apple IOS AND Ipados

CWE-190 — Integer Overflow or Wraparound8 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 81.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Apple IOS AND IpadosApple MacosApple Tvos+7 more
Timeline
PublishedMay 8

Description

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. Parsing a maliciously crafted plist may lead to an unexpected app termination or arbitrary code execution.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages15 packages

▶Appleapple/macos_monterey12.6.4
▶CVEListV5apple/macosunspecified — 13.3+2
▶NVDapple/macos12.0 — 12.6.4+2
▶Appleapple/macos_big_sur11.7.5

🔴Vulnerability Details

1
GHSA
GHSA-c7h9-q9qm-26xh: An integer overflow was addressed with improved input validation↗2023-05-08
▶

📋Vendor Advisories

6
Apple
CVE-2023-27937: macOS Monterey 12.6.4↗2023-03-27
▶
Apple
CVE-2023-27937: iOS 16.4 and iPadOS 16.4↗2023-03-27
▶
Apple
CVE-2023-27937: tvOS 16.4↗2023-03-27
▶
Apple
CVE-2023-27937: watchOS 9.4↗2023-03-27
▶
Apple
CVE-2023-27937: macOS Ventura 13.3↗2023-03-27
▶