Apple macOS vulnerabilities

CVE-2022-42811 [MEDIUM] CWE-284 CVE-2022-42811: An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1 An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. An app may be able to access user-sensitive data.

CVE-2022-42830 [MEDIUM] CWE-787 CVE-2022-42830: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.1 and iPadOS 16 The issue was addressed with improved memory handling. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privileges may be able to execute arbitrary code with kernel privileges.

CVE-2022-42789 [MEDIUM] CVE-2022-42789: An issue in code signature validation was addressed with improved checks. This issue is fixed in mac An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data.

CVE-2022-42832 [MEDIUM] CWE-362 CVE-2022-42832: A race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, A race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privileges may be able to execute arbitrary code with kernel privileges.

CVE-2022-32918 [MEDIUM] CWE-284 CVE-2022-32918: This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. An app may be able to bypass Privacy preferences.

CVE-2022-32938 [MEDIUM] CWE-22 CVE-2022-32938: A parsing issue in the handling of directory paths was addressed with improved path validation. This A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. A shortcut may be able to check the existence of an arbitrary path on the file system.

CVE-2022-42788 [MEDIUM] CWE-863 CVE-2022-42788: A permissions issue existed. This issue was addressed with improved permission validation. This issu A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malicious application may be able to read sensitive location information.

CVE-2022-32870 [LOW] CWE-200 CVE-2022-32870: A logic issue was addressed with improved state management. This issue is fixed in iOS 16, macOS Ven A logic issue was addressed with improved state management. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. A user with physical access to a device may be able to use Siri to obtain some call history information.

CVE-2022-32913 [LOW] CWE-200 CVE-2022-32913: The issue was addressed with additional restrictions on the observability of app states. This issue The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6, tvOS 16. A sandboxed app may be able to determine which app is currently using the camera.

CVE-2022-32879 [LOW] CVE-2022-32879: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, tvOS 16. A user with physical access to a device may be able to access contacts from the lock screen.

CVE-2022-32867 [LOW] CWE-922 CVE-2022-32867: This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. A user with physical access to an iOS device may be able to read past diagnostic logs.

CVE-2022-42915 [HIGH] CWE-415 CVE-2022-42915: curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to spe

CVE-2022-42916 [HIGH] CWE-319 CVE-2022-42916: In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using it In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replac

CVE-2022-1725 [MEDIUM] CWE-476 CVE-2022-1725: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.

CVE-2022-32847 [CRITICAL] CWE-119 CVE-2022-32847: This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macO This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2022-32845 [CRITICAL] CWE-693 CVE-2022-32845: This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPad This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to break out of its sandbox.

CVE-2022-32787 [HIGH] CWE-787 CVE-2022-32787: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2022-22629 [HIGH] CWE-787 CVE-2022-22629: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mo A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2022-32796 [HIGH] CWE-787 CVE-2022-32796: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.

CVE-2022-32798 [HIGH] CWE-787 CVE-2022-32798: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in ma An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.5. An app may be able to gain elevated privileges.