CVE-2023-32383 — Code Injection in Apple Macos

CWE-94 — Code InjectionCWE-606 — Unchecked Input for Loop Condition6 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.2%
top 63.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Apple MacosApple Macos BIG SURApple Macos Monterey+1 more
Timeline
PublishedJan 10
Latest updateJan 11

Description

This issue was addressed by forcing hardened runtime on the affected binaries at the system level. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur 11.7.7, macOS Ventura 13.4. An app may be able to inject code into sensitive binaries bundled with Xcode.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶Appleapple/macos_monterey12.6.6
▶CVEListV5apple/macosunspecified — 13.4+2
▶NVDapple/macos12.0.0 — 12.6.6+2
▶Appleapple/macos_big_sur11.7.7

🔴Vulnerability Details

1
GHSA
GHSA-hgv6-5hxf-xv66: This issue was addressed by forcing hardened runtime on the affected binaries at the system level↗2024-01-11
▶

📋Vendor Advisories

3
Apple
CVE-2023-32383: macOS Ventura 13.4↗2023-05-18
▶
Apple
CVE-2023-32383: macOS Big Sur 11.7.7↗2023-05-18
▶
Apple
CVE-2023-32383: macOS Monterey 12.6.6↗2023-05-18
▶