August 2022 - Security-announce

APPLE-SA-2022-08-31-1 iOS 12.5.6
by Apple Product Security via Security-announce 31 Aug '22

31 Aug '22

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-08-31-1 iOS 12.5.6 iOS 12.5.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213428. iOS 12 is not impacted by CVE-2022-32894. WebKit Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds write issue was addressed with improved bounds checking. WebKit Bugzilla: 243557 CVE-2022-32893: an anonymous researcher This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.5.6". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmMPsMkACgkQ4RjMIDke NxmXTQ//TeGVIwqrnMbCv1iIzp5NfxAMYv0pnALmXOkXFFEWLmowM3zGknGHYk5S HyMTDhpbMVEoNtyY/CKH71gZC08mt7p13Y08lbAphMZzbsSvsEjnxiKHE1cqaIp+ Txv9kZXHo4C1xT2LSJtfxy9EgF6aqjD8nYgNUueE8vZUg7KIOYdnCPACcGuWOonG Nkg4bsgGhMHuWay7Om6kjoyYv2AVDisfaF4lkFKD+c+5E1A2BYbz+OQt68XLqFT9 LZJY8LvUTWuYC6dmaZ3VJKDmlu3fybWyn1EAL5tpYzgEwmR/ooRkRuDWI4muj+Mm +WfuQdF53RlKSB91Mw1djMJu2puhcNkVNjLKiz22XFqt3MXaYkAcx/Ih7Bvt9Ajg GkH+asd7HvgODgiQNXq/PTz6+7JUx8XHlef+efBjIITNuAbTBO1bvdaojUQ8rd3Q pWXIUoMht6YlzYETf/ZeyZOvltIIdHxFnplh7YBI4Alw11NFFXeUyynjSQc14/Q0 ne1LT/JBNxaT0s8tudyRiqOZGn+xdgsDA63lWnOcuoqSCDEXlNhkJECFr492xzsA pe93jpskXfMeAw8FNXhl8UrRav5TbxOhMz60lac6hO7KPodbKh2fiIYZairZrEJh WrAmWos4/sYLMQyafQSCkTs7sy2jNQxjMWPhoZhsXZTy/w/ty1g= =/yG9 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2022-08-18-1 Safari 15.6.1
by Apple Product Security via Security-announce 18 Aug '22

18 Aug '22

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-08-18-1 Safari 15.6.1 Safari 15.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213414. WebKit Available for: macOS Big Sur and macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds write issue was addressed with improved bounds checking. WebKit Bugzilla: 243557 CVE-2022-32893: an anonymous researcher Safari 15.6.1 may be obtained from the Mac App Store. All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmL+gHUACgkQ4RjMIDke Nxm9eg/8CZFhmd5zgsQlwjn4R9kWVnIHCIzkhmjQGMzQ3C1FCiMwt+aDN2C1aYxN DiElfQy6ieI+4RNTxuNakhAQ0lS7F+TStHW9meblHkIA/qFfhBVxyaWZr+Hl0Bsw 2K+0D9twK6xqh88hlvdm/GGEkEv8pKXKtzWaDoOdutXtasG6apc2nAMcqcWyN3SE hw+/PXhnxY5TNDQsz4wYsriichEPHIPJh3tCEgV2EvfsYx3GrX8Yga3T34GHwSj7 H04Q3P1vNkdDDziFV7gZuWVXqKrpQxnReIKtZzffO0cW2x7lsSKw3H70yHlh2JLL yUDP28jJXOFGHD3izx+YHmFB4Q4dcHSVsil39Mq150s5iyJSkO2YDgWCyZBQ1tuB /dLIGuuQQtA3CqzBPSKneeeb0Cf5I6dnjh93R/aXLNiy+1AvizxJFOJ+EAlDCOxt o85iZxjWaGaQxng3qeA5nex5QWUvXRPyXoxyxnkfEeswv7PX6XLQXTASIo/Ug3E8 KcIbtnkPatuwHt44eprrW6afaWhiY2IhiLKRFQeDm5vtYOr0FDAWGKl9bW203Frt 2o6TVP9uXxZRIfMUmxBjdvNFScez49vlU6v+cIjj8UON/lWKZLkLDEFxfCWxlAWK eTc6a0tIAP5EMyd7EZdVhvxJSMxcCrXiO2iiS5TccIFZ5VvgZwA= =t1cZ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2022-08-17-2 macOS Monterey 12.5.1
by Apple Product Security via Security-announce 17 Aug '22

17 Aug '22

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-08-17-2 macOS Monterey 12.5.1 macOS Monterey 12.5.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213413. Kernel Available for: macOS Monterey Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-32894: an anonymous researcher WebKit Available for: macOS Monterey Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds write issue was addressed with improved bounds checking. WebKit Bugzilla: 243557 CVE-2022-32893: an anonymous researcher macOS Monterey 12.5.1 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmL9UiYACgkQ4RjMIDke NxkMiQ/+JkF0Octgd1/I72UFVdhIbUrvL+BkQdTWXfzrfGpFl3EOSUkvn+F3qmt4 pAxtbKeg4T5VyJqGz+bQDOZ+VXGsO4w/9n0WWjEGA/P+BHkP2gUZLlhZQRq1XY5c gW8EBiUEA20qtz9s0AUFOtS8l6J1QStOhA5W6OWS4xJp4GTwFKSbZHDrHjACBoi1 5XpFM0H5sbFG66C9Fb+p55BLWMBoyxbi8YiQIDmcZ7/+kNGSsBkfHtvSmoFaSVr1 vP/2o2zEUburmKy9C9nUrXruJB6oqjWrkKfe2bbHOa9Zpf9zPcDyYXFbpJLYyAov R2h8pTppfxdPpuFKVht+MUpc9VnW8oZsuk0bWiI/D9dAOX1otoLE1599SXy/rXSU 2SLeM+Uv4iiJGiNSfDuvcCCqhzCCUf2/pS8VTcnDZczsOGPLWROswzQ46yVWHIxO iCNH8iHliDo5UNzem+yza5hRgjDbArEjoP10zzx2AxFioQuJXWWEWIbcb966MKzs gL+DB2BqVhF+OScf+jC66BefgSndsGBfkKgulrZ1HOmJ2E/BwOCYKYrDQhtNEJbr dFjv8+cMO1vuqKb33p5rjzNIqucBYEuoLtIaXz1yJ5aF/3M5HVaqBgBFioQHUvKj zc/QF2P6Ue3AMhUkmkMkZVJRMYI966fFD9NMKjGz9H/gCm+8iN0= =4ABQ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2022-08-17-1 iOS 15.6.1 and iPadOS 15.6.1
by Apple Product Security via Security-announce 17 Aug '22

17 Aug '22

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-08-17-1 iOS 15.6.1 and iPadOS 15.6.1 iOS 15.6.1 and iPadOS 15.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213412. Kernel Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-32894: an anonymous researcher WebKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds write issue was addressed with improved bounds checking. WebKit Bugzilla: 243557 CVE-2022-32893: an anonymous researcher This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 15.6.1 and iPadOS 15.6.1". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmL9UiMACgkQ4RjMIDke Nxkiuw/+IhqxvCCS9q8hQMHDpFvVVmFdfO+7ukTVSpd12Cp5r0VGVP/zJOCecXR1 cnFHIPx8zVZXzQzsa+lCSWhT+20qOiuCjpqWNVY9pCovCPds3r1hhL2/1H0KejGK 2Ms910r+yxvEmhzz0MPk95d5+k+LaBPC1sfuNVTn9eUXImPDuLzLIyd8nW5khjNW spOIlS82VNBAcw8VQMxjgsiD6lhSsqvdkBPNhbI4/mMeIEXOOb+fRtHUOtorGLF2 R1DzU1zmPLytcPGE+hxVXnR5F1z/+ea1DEWumvzSNfwja9HI2xPfmm9E8Pomq9lk SEW8cxlqAdKY2/cQ2B2I7ihJ3REfJjSnhXqTsuad1jVn9k1t8ZmKBWh6bgOQKQQg 9BfIhcCeL398fmRUZQG1h6zo33MukUMMjfTgRjrjxhETLYCZQybjFAC4s98j2S0o yUpKaBUHc+tL/uupW01LwzP53SR2e4rBQhi+ACqiCEoJKAHYfJaj6YeblILiM6Sa QdfbsiCzSIqM6nJLl5ZIYn6rXEEKGyGpKMAYXvc7FsR691DTQxMiQ8KcraoCwAer LzviWOF2tVNmDYkv5EFnXhSB4+uYzViSQhPKM8s2DRhP/WhxdVF3woRhIyHLq60S qKoFKvQwTVTugIFIR4cGfsfAbV7zCBhqH7+fKBGfLeTOBCH7ULE= =SLRt -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0