Action not permitted
Modal body text goes here.
CVE-2022-22591
Vulnerability from cvelistv5
▼ | URL | Tags | |
---|---|---|---|
product-security@apple.com | https://support.apple.com/en-us/HT213054 | Release Notes, Vendor Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T03:14:55.767Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://support.apple.com/en-us/HT213054" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "12.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "A malicious application may be able to execute arbitrary code with kernel privileges", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-03-18T17:59:19", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://support.apple.com/en-us/HT213054" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "product-security@apple.com", "ID": "CVE-2022-22591", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "macOS", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "12.2" } ] } } ] }, "vendor_name": "Apple" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "A malicious application may be able to execute arbitrary code with kernel privileges" } ] } ] }, "references": { "reference_data": [ { "name": "https://support.apple.com/en-us/HT213054", "refsource": "MISC", "url": "https://support.apple.com/en-us/HT213054" } ] } } } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2022-22591", "datePublished": "2022-03-18T17:59:19", "dateReserved": "2022-01-05T00:00:00", "dateUpdated": "2024-08-03T03:14:55.767Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-22591\",\"sourceIdentifier\":\"product-security@apple.com\",\"published\":\"2022-03-18T18:15:12.720\",\"lastModified\":\"2022-03-26T03:58:32.277\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges.\"},{\"lang\":\"es\",\"value\":\"Se abord\u00f3 un problema de corrupci\u00f3n de memoria con un manejo de memoria mejorado. Este problema es corregido en macOS Monterey versi\u00f3n 12.2. Una aplicaci\u00f3n maliciosa puede ser capaz de ejecutar c\u00f3digo arbitrario con privilegios del n\u00facleo\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":9.3},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndExcluding\":\"12.2\",\"matchCriteriaId\":\"5BD8A840-1C3E-4D4B-B497-250712283BCC\"}]}]}],\"references\":[{\"url\":\"https://support.apple.com/en-us/HT213054\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]}]}}" } }
ghsa-p7fh-cg9f-wr8w
Vulnerability from github
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges.
{ "affected": [], "aliases": [ "CVE-2022-22591" ], "database_specific": { "cwe_ids": [ "CWE-787" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2022-03-18T18:15:00Z", "severity": "HIGH" }, "details": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges.", "id": "GHSA-p7fh-cg9f-wr8w", "modified": "2022-03-27T00:00:47Z", "published": "2022-03-19T00:00:58Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22591" }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213054" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
var-202201-0457
Vulnerability from variot
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. macOS Monterey Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Information about the security content is also available at https://support.apple.com/HT213054. CVE-2022-22586: an anonymous researcher
ColorSync Available for: macOS Monterey Impact: Processing a maliciously crafted file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2022-22584: Mickey Jin (@patch1t) of Trend Micro
Crash Reporter Available for: macOS Monterey Impact: A malicious application may be able to gain root privileges Description: A logic issue was addressed with improved validation. CVE-2022-22578: an anonymous researcher
iCloud Available for: macOS Monterey Impact: An application may be able to access a user's files Description: An issue existed within the path validation logic for symlinks. CVE-2022-22585: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (https://xlab.tencent.com)
Intel Graphics Driver Available for: macOS Monterey Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. Apple is aware of a report that this issue may have been actively exploited. CVE-2022-22593: Peter Nguyễn Vũ Hoàng of STAR Labs
Model I/O Available for: macOS Monterey Impact: Processing a maliciously crafted STL file may lead to unexpected application termination or arbitrary code execution Description: An information disclosure issue was addressed with improved state management. CVE-2022-22579: Mickey Jin (@patch1t) of Trend Micro
PackageKit Available for: macOS Monterey Impact: An application may be able to access restricted files Description: A permissions issue was addressed with improved validation. CVE-2022-22583: an anonymous researcher, Mickey Jin (@patch1t), Ron Hass (@ronhass7) of Perception Point
WebKit Available for: macOS Monterey Impact: Processing a maliciously crafted mail message may lead to running arbitrary javascript Description: A validation issue was addressed with improved input sanitization. CVE-2022-22589: Heige of KnownSec 404 Team (knownsec.com) and Bo Qu of Palo Alto Networks (paloaltonetworks.com)
WebKit Available for: macOS Monterey Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2022-22590: Toan Pham from Team Orca of Sea Security (security.sea.com)
WebKit Available for: macOS Monterey Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A logic issue was addressed with improved state management. CVE-2022-22592: Prakash (@1lastBr3ath)
WebKit Storage Available for: macOS Monterey Impact: A website may be able to track sensitive user information Description: A cross-origin issue in the IndexDB API was addressed with improved input validation. CVE-2022-22594: Martin Bajanik of FingerprintJS
Additional recognition
Kernel We would like to acknowledge Tao Huang for their assistance.
Metal We would like to acknowledge Tao Huang for their assistance.
PackageKit We would like to acknowledge Mickey Jin (@patch1t), Mickey Jin (@patch1t) of Trend Micro for their assistance.
WebKit We would like to acknowledge Prakash (@1lastBr3ath) for their assistance.
Installation note:
This update may be obtained from the Mac App Store
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmHx0zEACgkQeC9qKD1p rhhFUw/+K0ImMkw8zCjqdJza05Y6mlSa2wAdoVQK4pywYylcWMzemOi9GStr1Tgq CmA7KFo2hPp/9kh6+SURi91WwUKdNHsDfasjNDqTTOJalQFuKB0erZgEpcprBnHE lzT2heSJDl58sMSn0hLlGIhLfc+4Ld29FKc3lmtBPGeKY3vUViHLN0s3sZj07twx Ew7yYkDBkz/e2kGRDByWzmvsSQt+w7HMK+pN1m5CBTZdP8KAHVtbuv8BPtMHKwNJ 1Kzo6nW4MJ9Eds63Lz4A37nqTNxmvsbf4zDSppwAp8NalEHqg5My7PzmK97eh6ap jS4P4LqdRigTvRMq3eDVh/4Lie+/39nXwdQI6czETvTYzi+iA6k3q1Lsf2eIYzCf 0y4YTKEwIze05Q45YqbbnRDfVGOKtfZOcFVYsMxYBHBMp6LDcLJ9i0+AORX2igoA dODLICbrHzexa682FDE2RGtgQOtS5k4LJLUggvSeOW/tXN+MovfVTjCIzJSKYltP eQm8gq3EajaRk4JQcYkxklalyOHVZpkg3+u6Az+xIY5nVVijkuGDqqiCoh62zmsE kSXZrfuJTIYWbIzpR23xVMyxWBcN4AXDE3xLeZajm0yGnAxpd8CGwb4FhgipcDVE wwazu76IYBPpP40AyBALO10aXhYjrI+Bj6zI+Ug3msXLhkeICtI= =WEmw -----END PGP SIGNATURE-----
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202201-0457", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "macos", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "12.2" }, { "model": "macos", "scope": "gte", "trust": 1.0, "vendor": "apple", "version": "12.0.0" }, { "model": "macos", "scope": "eq", "trust": 0.8, "vendor": "\u30a2\u30c3\u30d7\u30eb", "version": null }, { "model": "macos", "scope": "eq", "trust": 0.8, "vendor": "\u30a2\u30c3\u30d7\u30eb", "version": "12.2" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "db": "NVD", "id": "CVE-2022-22591" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "12.2", "versionStartIncluding": "12.0.0", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2022-22591" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Apple", "sources": [ { "db": "PACKETSTORM", "id": "165772" } ], "trust": 0.1 }, "cve": "CVE-2022-22591", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 8.6, "impactScore": 10.0, "integrityImpact": "COMPLETE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": true, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Complete", "baseScore": 9.3, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "CVE-2022-22591", "impactScore": null, "integrityImpact": "Complete", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.9, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 8.6, "id": "VHN-411219", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.8, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Local", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.8, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2022-22591", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2022-22591", "trust": 1.8, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-202201-2404", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-411219", "trust": 0.1, "value": "HIGH" }, { "author": "VULMON", "id": "CVE-2022-22591", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-411219" }, { "db": "VULMON", "id": "CVE-2022-22591" }, { "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "db": "CNNVD", "id": "CNNVD-202201-2404" }, { "db": "NVD", "id": "CVE-2022-22591" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. macOS Monterey Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. \nInformation about the security content is also available at \nhttps://support.apple.com/HT213054. \nCVE-2022-22586: an anonymous researcher\n\nColorSync\nAvailable for: macOS Monterey\nImpact: Processing a maliciously crafted file may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2022-22584: Mickey Jin (@patch1t) of Trend Micro\n\nCrash Reporter\nAvailable for: macOS Monterey\nImpact: A malicious application may be able to gain root privileges\nDescription: A logic issue was addressed with improved validation. \nCVE-2022-22578: an anonymous researcher\n\niCloud\nAvailable for: macOS Monterey\nImpact: An application may be able to access a user\u0027s files\nDescription: An issue existed within the path validation logic for\nsymlinks. \nCVE-2022-22585: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab\n(https://xlab.tencent.com)\n\nIntel Graphics Driver\nAvailable for: macOS Monterey\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. Apple is aware of a report that this issue\nmay have been actively exploited. \nCVE-2022-22593: Peter Nguy\u1ec5n V\u0169 Ho\u00e0ng of STAR Labs\n\nModel I/O\nAvailable for: macOS Monterey\nImpact: Processing a maliciously crafted STL file may lead to\nunexpected application termination or arbitrary code execution\nDescription: An information disclosure issue was addressed with\nimproved state management. \nCVE-2022-22579: Mickey Jin (@patch1t) of Trend Micro\n\nPackageKit\nAvailable for: macOS Monterey\nImpact: An application may be able to access restricted files\nDescription: A permissions issue was addressed with improved\nvalidation. \nCVE-2022-22583: an anonymous researcher, Mickey Jin (@patch1t), Ron\nHass (@ronhass7) of Perception Point\n\nWebKit\nAvailable for: macOS Monterey\nImpact: Processing a maliciously crafted mail message may lead to\nrunning arbitrary javascript\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2022-22589: Heige of KnownSec 404 Team (knownsec.com) and Bo Qu\nof Palo Alto Networks (paloaltonetworks.com)\n\nWebKit\nAvailable for: macOS Monterey\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2022-22590: Toan Pham from Team Orca of Sea Security\n(security.sea.com)\n\nWebKit\nAvailable for: macOS Monterey\nImpact: Processing maliciously crafted web content may prevent\nContent Security Policy from being enforced\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2022-22592: Prakash (@1lastBr3ath)\n\nWebKit Storage\nAvailable for: macOS Monterey\nImpact: A website may be able to track sensitive user information\nDescription: A cross-origin issue in the IndexDB API was addressed\nwith improved input validation. \nCVE-2022-22594: Martin Bajanik of FingerprintJS\n\nAdditional recognition\n\nKernel\nWe would like to acknowledge Tao Huang for their assistance. \n\nMetal\nWe would like to acknowledge Tao Huang for their assistance. \n\nPackageKit\nWe would like to acknowledge Mickey Jin (@patch1t), Mickey Jin\n(@patch1t) of Trend Micro for their assistance. \n\nWebKit\nWe would like to acknowledge Prakash (@1lastBr3ath) for their\nassistance. \n\nInstallation note:\n\nThis update may be obtained from the Mac App Store\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmHx0zEACgkQeC9qKD1p\nrhhFUw/+K0ImMkw8zCjqdJza05Y6mlSa2wAdoVQK4pywYylcWMzemOi9GStr1Tgq\nCmA7KFo2hPp/9kh6+SURi91WwUKdNHsDfasjNDqTTOJalQFuKB0erZgEpcprBnHE\nlzT2heSJDl58sMSn0hLlGIhLfc+4Ld29FKc3lmtBPGeKY3vUViHLN0s3sZj07twx\nEw7yYkDBkz/e2kGRDByWzmvsSQt+w7HMK+pN1m5CBTZdP8KAHVtbuv8BPtMHKwNJ\n1Kzo6nW4MJ9Eds63Lz4A37nqTNxmvsbf4zDSppwAp8NalEHqg5My7PzmK97eh6ap\njS4P4LqdRigTvRMq3eDVh/4Lie+/39nXwdQI6czETvTYzi+iA6k3q1Lsf2eIYzCf\n0y4YTKEwIze05Q45YqbbnRDfVGOKtfZOcFVYsMxYBHBMp6LDcLJ9i0+AORX2igoA\ndODLICbrHzexa682FDE2RGtgQOtS5k4LJLUggvSeOW/tXN+MovfVTjCIzJSKYltP\neQm8gq3EajaRk4JQcYkxklalyOHVZpkg3+u6Az+xIY5nVVijkuGDqqiCoh62zmsE\nkSXZrfuJTIYWbIzpR23xVMyxWBcN4AXDE3xLeZajm0yGnAxpd8CGwb4FhgipcDVE\nwwazu76IYBPpP40AyBALO10aXhYjrI+Bj6zI+Ug3msXLhkeICtI=\n=WEmw\n-----END PGP SIGNATURE-----\n\n\n", "sources": [ { "db": "NVD", "id": "CVE-2022-22591" }, { "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "db": "VULHUB", "id": "VHN-411219" }, { "db": "VULMON", "id": "CVE-2022-22591" }, { "db": "PACKETSTORM", "id": "165772" } ], "trust": 1.89 }, "exploit_availability": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "reference": "https://www.scap.org.cn/vuln/vhn-411219", "trust": 0.1, "type": "unknown" } ], "sources": [ { "db": "VULHUB", "id": "VHN-411219" } ] }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2022-22591", "trust": 3.5 }, { "db": "PACKETSTORM", "id": "165772", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2022-009001", "trust": 0.8 }, { "db": "AUSCERT", "id": "ESB-2022.0399", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2022012635", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202201-2404", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-411219", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2022-22591", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-411219" }, { "db": "VULMON", "id": "CVE-2022-22591" }, { "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "db": "PACKETSTORM", "id": "165772" }, { "db": "CNNVD", "id": "CNNVD-202201-2404" }, { "db": "NVD", "id": "CVE-2022-22591" } ] }, "id": "VAR-202201-0457", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-411219" } ], "trust": 0.01 }, "last_update_date": "2024-02-13T21:41:29.416000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "HT213054", "trust": 0.8, "url": "https://support.apple.com/en-us/ht213054" }, { "title": "Apple macOS Buffer error vulnerability fix", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=179623" }, { "title": "CVE-2022-XXXX", "trust": 0.1, "url": "https://github.com/alphabugx/cve-2022-23305 " }, { "title": "CVE-2022-XXXX", "trust": 0.1, "url": "https://github.com/alphabugx/cve-2022-rce " } ], "sources": [ { "db": "VULMON", "id": "CVE-2022-22591" }, { "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "db": "CNNVD", "id": "CNNVD-202201-2404" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-787", "trust": 1.1 }, { "problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "VULHUB", "id": "VHN-411219" }, { "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "db": "NVD", "id": "CVE-2022-22591" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.4, "url": "https://support.apple.com/en-us/ht213054" }, { "trust": 0.9, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22591" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2022.0399" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2022012635" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2022-22591/" }, { "trust": 0.6, "url": "https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-37394" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/165772/apple-security-advisory-2022-01-26-2.html" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/787.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "http://seclists.org/fulldisclosure/2022/jan/82" }, { "trust": 0.1, "url": "https://github.com/alphabugx/cve-2022-23305" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22586" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22584" }, { "trust": 0.1, "url": "https://support.apple.com/kb/ht201222" }, { "trust": 0.1, "url": "https://support.apple.com/ht213054." }, { "trust": 0.1, "url": "https://xlab.tencent.com)" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22594" }, { "trust": 0.1, "url": "https://www.apple.com/support/security/pgp/" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22589" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22593" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22587" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22590" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22585" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22579" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22583" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22578" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22592" } ], "sources": [ { "db": "VULHUB", "id": "VHN-411219" }, { "db": "VULMON", "id": "CVE-2022-22591" }, { "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "db": "PACKETSTORM", "id": "165772" }, { "db": "CNNVD", "id": "CNNVD-202201-2404" }, { "db": "NVD", "id": "CVE-2022-22591" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-411219" }, { "db": "VULMON", "id": "CVE-2022-22591" }, { "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "db": "PACKETSTORM", "id": "165772" }, { "db": "CNNVD", "id": "CNNVD-202201-2404" }, { "db": "NVD", "id": "CVE-2022-22591" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-03-18T00:00:00", "db": "VULHUB", "id": "VHN-411219" }, { "date": "2022-03-18T00:00:00", "db": "VULMON", "id": "CVE-2022-22591" }, { "date": "2023-08-02T00:00:00", "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "date": "2022-01-31T15:46:05", "db": "PACKETSTORM", "id": "165772" }, { "date": "2022-01-26T00:00:00", "db": "CNNVD", "id": "CNNVD-202201-2404" }, { "date": "2022-03-18T18:15:12.720000", "db": "NVD", "id": "CVE-2022-22591" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-03-26T00:00:00", "db": "VULHUB", "id": "VHN-411219" }, { "date": "2022-03-26T00:00:00", "db": "VULMON", "id": "CVE-2022-22591" }, { "date": "2023-08-02T06:53:00", "db": "JVNDB", "id": "JVNDB-2022-009001" }, { "date": "2022-03-28T00:00:00", "db": "CNNVD", "id": "CNNVD-202201-2404" }, { "date": "2022-03-26T03:58:32.277000", "db": "NVD", "id": "CVE-2022-22591" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "CNNVD", "id": "CNNVD-202201-2404" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "macOS\u00a0Monterey\u00a0 Out-of-bounds write vulnerability in", "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-009001" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "buffer error", "sources": [ { "db": "CNNVD", "id": "CNNVD-202201-2404" } ], "trust": 0.6 } }
wid-sec-w-2023-1213
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Apple macOS ist ein Betriebssystem, das auf FreeBSD und Mach basiert.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Apple macOS (Monterey) ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- MacOS X", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1213 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2023-1213.json" }, { "category": "self", "summary": "WID-SEC-2023-1213 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1213" }, { "category": "external", "summary": "Apple Security Advisory vom 2022-01-26", "url": "https://support.apple.com/en-us/HT213054" } ], "source_lang": "en-US", "title": "Apple macOS (Monterey): Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-05-14T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:27:37.821+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1213", "initial_release_date": "2022-01-26T23:00:00.000+00:00", "revision_history": [ { "date": "2022-01-26T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-01-27T23:00:00.000+00:00", "number": "2", "summary": "Referenz(en) aufgenommen: APPLE-SA-2022-01-26-2" }, { "date": "2023-05-14T22:00:00.000+00:00", "number": "3", "summary": "CVE-2022-22646, CVE-2022-22676 erg\u00e4nzt" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Apple macOS Monterey \u003c 12.2", "product": { "name": "Apple macOS Monterey \u003c 12.2", "product_id": "T021864", "product_identification_helper": { "cpe": "cpe:/o:apple:mac_os:monterey_12.2" } } } ], "category": "vendor", "name": "Apple" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-22676", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22676" }, { "cve": "CVE-2022-22646", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22646" }, { "cve": "CVE-2022-22594", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22594" }, { "cve": "CVE-2022-22593", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22593" }, { "cve": "CVE-2022-22592", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22592" }, { "cve": "CVE-2022-22591", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22591" }, { "cve": "CVE-2022-22590", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22590" }, { "cve": "CVE-2022-22589", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22589" }, { "cve": "CVE-2022-22587", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22587" }, { "cve": "CVE-2022-22586", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22586" }, { "cve": "CVE-2022-22585", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22585" }, { "cve": "CVE-2022-22584", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22584" }, { "cve": "CVE-2022-22583", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22583" }, { "cve": "CVE-2022-22579", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22579" }, { "cve": "CVE-2022-22578", "notes": [ { "category": "description", "text": "In Apple macOS existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten AMD Kernel, ColorSync, Crash Reporter, iCloud, Intel Graphics Driver, IOMobileFrameBuffer, Kernel, Model I/O, PackageKit, WebKit und WebKit Storage. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit Kernel-Privilegien auszuf\u00fchren, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsma\u00dfnahmen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder bestimmte Privilegien." } ], "release_date": "2022-01-26T23:00:00Z", "title": "CVE-2022-22578" } ] }
gsd-2022-22591
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-22591", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges.", "id": "GSD-2022-22591" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-22591" ], "details": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges.", "id": "GSD-2022-22591", "modified": "2023-12-13T01:19:29.694297Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "product-security@apple.com", "ID": "CVE-2022-22591", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "macOS", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "12.2" } ] } } ] }, "vendor_name": "Apple" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "A malicious application may be able to execute arbitrary code with kernel privileges" } ] } ] }, "references": { "reference_data": [ { "name": "https://support.apple.com/en-us/HT213054", "refsource": "MISC", "url": "https://support.apple.com/en-us/HT213054" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "12.2", "versionStartIncluding": "12.0.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "product-security@apple.com", "ID": "CVE-2022-22591" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-787" } ] } ] }, "references": { "reference_data": [ { "name": "https://support.apple.com/en-us/HT213054", "refsource": "MISC", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "https://support.apple.com/en-us/HT213054" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9 } }, "lastModifiedDate": "2022-03-26T03:58Z", "publishedDate": "2022-03-18T18:15Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.