mickmick.net

Apple Products Multiple Vulnerabilities

Release Date: 25 Jul 2023

RISK: Extremely High Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Apple Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure, data manipulation and security restriction bypass on the targeted system.

 

Note:

CVE-2023-38606 and CVE-2023-37450 are being exploited in the wild. These vulnerabilities are related to the Kernel and WebKit components that may lead to arbitrary code execution.

 

For CVE-2023-38606, an app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.

 

For CVE-2023-37450, processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

---

Impact

• Remote Code Execution
• Denial of Service
• Elevation of Privilege
• Security Restriction Bypass
• Information Disclosure
• Data Manipulation

---

System / Technologies affected

• Versions prior to Safari 16.6
• Versions prior to iOS 16.6 and iPadOS 16.6
• Versions prior to iOS 15.7.8 and iPadOS 15.7.8
• Versions prior to macOS Ventura 13.5
• Versions prior to macOS Monterey 12.6.8
• Versions prior to macOS Big Sur 11.7.9
• Versions prior to tvOS 16.6
• Versions prior to watchOS 9.6

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Safari 16.6
• iOS 16.6 and iPadOS 16.6
• iOS 15.7.8 and iPadOS 15.7.8
• macOS Ventura 13.5
• macOS Monterey 12.6.8
• macOS Big Sur 11.7.9
• tvOS 16.6
• watchOS 9.6

---

Vulnerability Identifier

• CVE-2023-2953
• CVE-2023-23540
• CVE-2023-28319
• CVE-2023-28320
• CVE-2023-28321
• CVE-2023-28322
• CVE-2023-32364
• CVE-2023-32381
• CVE-2023-32409
• CVE-2023-32416
• CVE-2023-32418
• CVE-2023-32429
• CVE-2023-32433
• CVE-2023-32437
• CVE-2023-32441
• CVE-2023-32442
• CVE-2023-32443
• CVE-2023-32734
• CVE-2023-35983
• CVE-2023-35993
• CVE-2023-36854
• CVE-2023-36862
• CVE-2023-37450
• CVE-2023-38133
• CVE-2023-38136
• CVE-2023-38258
• CVE-2023-38259
• CVE-2023-38261
• CVE-2023-38410
• CVE-2023-38421
• CVE-2023-38424
• CVE-2023-38425
• CVE-2023-38564
• CVE-2023-38565
• CVE-2023-38572
• CVE-2023-38580
• CVE-2023-38593
• CVE-2023-38594
• CVE-2023-38595
• CVE-2023-38597
• CVE-2023-38600
• CVE-2023-38602
• CVE-2023-38603
• CVE-2023-38606
• CVE-2023-38608
• CVE-2023-38611

---

Source

• Apple

---

Related Link

• https://support.apple.com/en-us/HT213848
• https://support.apple.com/en-us/HT213847
• https://support.apple.com/en-us/HT213846
• https://support.apple.com/en-us/HT213845
• https://support.apple.com/en-us/HT213844
• https://support.apple.com/en-us/HT213843
• https://support.apple.com/en-us/HT213842
• https://support.apple.com/en-us/HT213841