January 2024 - Security-announce

APPLE-SA-01-22-2024-9 tvOS 17.3
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-9 tvOS 17.3 tvOS 17.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214055. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Apple Neural Engine Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23212: Ye Zhang of Baidu Security CoreCrypto Available for: Apple TV HD and Apple TV 4K (all models) Impact: An attacker may be able to decrypt legacy RSA PKCS#1 v1.5 ciphertexts without having the private key Description: A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. CVE-2024-23218: Clemens Lang Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23208: fmyy(@binary_fmyy) and lime From TIANGONG Team of Legendsec at QI-ANXIN Group NSSpellChecker Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved handling of files. CVE-2024-23223: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) TCC Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access user-sensitive data Description: An issue was addressed with improved handling of temporary files. CVE-2024-23215: Zhongquan Li (@Guluisacat) Time Zone Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to view a user's phone number in system logs Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23210: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 262699 CVE-2024-23206: an anonymous researcher WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 266619 CVE-2024-23213: Wangtaiyu of Zhongfu info WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 267134 CVE-2024-23222 Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDyQACgkQX+5d1TXa IvoUsA//bw9u1+Jxh79G7jV7SXt8HRV8yqr16Bhq00AqSdDx/RgVGTUs6cN8OfGX MVda91yeQS7WOEtrw7no8vD2HcGSvcTCRWTRQRSYJjZfZ4C3v9Rnt3Nlx/mvdLQg 50Kn3Gm46C/+iFhuZhtSa9VrDhoaiLs3Wb9nVBrQ917CyNMXeDb1JuP1MOjPJgiJ IVZlcIwAFrx4f779ove/MtupyeeoHZwV1KICEDyVIZsUGMGf4ti6J8tdK73EmUPo a1Q6pRx8JRwtXBPkp/1PerRsfzb9bRAksZU6R5d8RdJBTpnx9kfZZpPWknyRX2R9 gR6tJrswgHcalkHDL6UXJfnWS3XCrCHg2jKQbWPDvor6juOMUKfi40ww36H6KdRG ksNdFaWhmSK0Qu1EqS4bmCWYiUx16O/js7tbbNfXFp+ssjMtjunlVs9Ly3Jh2Fpi gry4IRE5Ll4oryFxUPV9KGM72eDL8PAwvIgDXx5/NkcrZIGZNl9eseJCsfZ/AV7Z dZTcc78Yguenm5Nsot6GmL1q0+LCj48PmcFu6VQF7KSFWcehAKjVIk+DaAOJITgF uJekaVJp3mVe5XRvtQrfMlegiog40gPxQgwJ/psUyp3Ss5uIOPF6EUrAj2xqERRc GVDDKWA3BFSCOJD/dtR/xmiwJdRMQwomeo8k1uUpd96ICM6VgJM= =HfBk -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-01-22-2024-8 watchOS 10.3
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-8 watchOS 10.3 watchOS 10.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214060. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Apple Neural Engine Available for devices with Apple Neural Engine: Apple Watch Series 9 and Apple Watch Ultra 2 Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23212: Ye Zhang of Baidu Security CoreCrypto Available for: Apple Watch Series 4 and later Impact: An attacker may be able to decrypt legacy RSA PKCS#1 v1.5 ciphertexts without having the private key Description: A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. CVE-2024-23218: Clemens Lang Kernel Available for: Apple Watch Series 4 and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23208: fmyy(@binary_fmyy) and lime From TIANGONG Team of Legendsec at QI-ANXIN Group Mail Search Available for: Apple Watch Series 4 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23207: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab), and Ian de Marcellus NSSpellChecker Available for: Apple Watch Series 4 and later Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved handling of files. CVE-2024-23223: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Safari Available for: Apple Watch Series 4 and later Impact: A user's private browsing activity may be visible in Settings Description: A privacy issue was addressed with improved handling of user preferences. CVE-2024-23211: Mark Bowers Shortcuts Available for: Apple Watch Series 4 and later Impact: A shortcut may be able to use sensitive data with certain actions without prompting the user Description: The issue was addressed with additional permissions checks. CVE-2024-23204: Jubaer Alnazi (@h33tjubaer) Shortcuts Available for: Apple Watch Series 4 and later Impact: An app may be able to bypass certain Privacy preferences Description: A privacy issue was addressed with improved handling of temporary files. CVE-2024-23217: Kirin (@Pwnrin) TCC Available for: Apple Watch Series 4 and later Impact: An app may be able to access user-sensitive data Description: An issue was addressed with improved handling of temporary files. CVE-2024-23215: Zhongquan Li (@Guluisacat) Time Zone Available for: Apple Watch Series 4 and later Impact: An app may be able to view a user's phone number in system logs Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23210: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) WebKit Available for: Apple Watch Series 4 and later Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 262699 CVE-2024-23206: an anonymous researcher WebKit Available for: Apple Watch Series 4 and later Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 266619 CVE-2024-23213: Wangtaiyu of Zhongfu info Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDqsACgkQX+5d1TXa IvqR0Q//a137PlcPioIws/A02XClBQtF95fwuaz7DEhi79XZvH1q1+N3EYd/1b8l YkGdXQik8uS4zpB4KBJ+8cRYqaNaMDO0lNr2RdGgUInMd2bc+HBHigxEY47Wzbr2 UT3r2uJW70HalBNrGNOj15JQTQ4MhbjjTq/ezrIdCFTo1RHk9vOc//AajbDtWiQp X5jGhoGzDB378vswEEyp4OjArh5v2xEv5hcoIvrzlgkSz9aRwzLgluR7sXGifE6O vU7zP2oT36zwBAfTsY1CkarTeQprQ4iyiEIlDzwxr+Z2ooGUmOStzsQtuU28QSQK sl0b42V7mkTFWVCXymsjCBbGw/JPSkGzptOPNqoEtBddiMuLU2BGBWk51xa5cEzy tsLWd1vlnUms3CqM6QvOxdj3mzs4wzxha941a0h67lR7NeR09CqflKsr7vDFWOBY PdVAUSDRxeM1rntVJfFJAkssUV14TGSTDwqMQmiUyxqXfKymSc4dCqIDLyqcdblB wNtwKFlstCZxcmc2V0zfDWHJ0y75sTUUhlk3AvH/OeVve9rhDvtKdoKDHdOauKHw kss00oy5TLkeTYi26oJfEMtts7BS+8ZEF3cLNxOBZ/cdIO1+Ifl8jNcluTLlC8F7 4MxcjC8prTl0aZ4sqJfcUBLnqkMdn0GaqXOPXSa6hQxiNc5dcIk= =hoM+ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-01-22-2024-7 macOS Monterey 12.7.3
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-7 macOS Monterey 12.7.3 macOS Monterey 12.7.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214057. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Accessibility Available for: macOS Monterey Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-42937: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Apple Neural Engine Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23212: Ye Zhang of Baidu Security curl Available for: macOS Monterey Impact: Multiple issues in curl Description: Multiple issues were addressed by updating to curl version 8.4.0. CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-42915 ImageIO Available for: macOS Monterey Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved checks. CVE-2023-42888: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Mail Search Available for: macOS Monterey Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23207: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab), and Ian de Marcellus WebKit Available for: macOS Monterey Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 267134 CVE-2024-23222 macOS Monterey 12.7.3 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDnUACgkQX+5d1TXa Ivqrqw//QZOnZpH5CnbfH10rxFF0CbZFRcHClM3RutihC4AuO5FedR3EDnUGyp53 eJADLlNz3dTg15scv6P4AuT+hg8k3OFEPi1f2jVgRxlqsW8a15iIXYGti8y4UVwo kQgzfxYv33zuY0yWlIlERIP7imIT0jNgwFKn+Gs2ZaBq1xw52xq3I/jf97txAQHX Rpe35hnhYS7eGlB8spErKGBgyTuOf+piL7zccb+G/Hw6Y8AwSLsvXg3lSgZavEWE UIBoYGLycszT9U7tybuPUJ83jD0lIqFNhGNzHM6BnajYJ8SVdAXqVfid8Km9ixoi Sm73F6ZlCrUSLxihjXz92NQnBXJM2AxVI3Z1QqsqxOTS9yrkHYSgFgqUxxaP7ONt voHYw6fuycYca9TbFPmu6aStW1UBNwMLWYgjxbuTqqs+OEI8DKGcHIihGPQ184jW VF1bYNK8bvRMM+n/kaIHNo9/AyPnnSjmEOzr946ypg90FvTy3Wu1HhUm1MslzjNC LG5j6/hh0H7MXii8o5UL4ayabnPyZbWJrhRntvwx86xTLV9DPwmuwvxeVWm87Wu0 EYC/XRAbtspHXMn5ItTNgqGbf0lKlrluXrAW79EFQdvPyD/Fzyljb+W9o2w1IA/9 O8oXMVxqM4W+iRokcDbcbNQI3J2xGaP8FNwG6EEBB+bKkNWZ0m0= =zFhG -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-01-22-2024-6 macOS Ventura 13.6.4
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-6 macOS Ventura 13.6.4 macOS Ventura 13.6.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214058. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Apple Neural Engine Available for: macOS Ventura Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23212: Ye Zhang of Baidu Security Accessibility Available for: macOS Ventura Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-42937: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Core Data Available for: macOS Ventura Impact: An app may be able to bypass Privacy preferences Description: This issue was addressed by removing the vulnerable code. CVE-2023-40528: Kirin (@Pwnrin) of NorthSea curl Available for: macOS Ventura Impact: Multiple issues in curl Description: Multiple issues were addressed by updating to curl version 8.4.0. CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-42915 Finder Available for: macOS Ventura Impact: An app may be able to access sensitive user data Description: The issue was addressed with improved checks. CVE-2024-23224: Brian McNulty ImageIO Available for: macOS Ventura Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved checks. CVE-2023-42888: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative LoginWindow Available for: macOS Ventura Impact: A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen Description: An authentication issue was addressed with improved state management. CVE-2023-42935 Mail Search Available for: macOS Ventura Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23207: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab), and Ian de Marcellus NSOpenPanel Available for: macOS Ventura Impact: An app may be able to read arbitrary files Description: An access issue was addressed with additional sandbox restrictions. CVE-2023-42887: Ron Masas of BreakPoint.sh WebKit Available for: macOS Ventura Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 267134 CVE-2024-23222 macOS Ventura 13.6.4 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDk0ACgkQX+5d1TXa IvrWTw/8DbDE/5ejAyR2F08VphoiOnJD5URY5WINPWVWps0w9svMI83Ig+MLlbVY APek5kQlSVJJoI7RXrSxgRCs3gcWVWVo08iVIM6woBbsd5JPaTYXe9/yUdRzWBX4 zgOxvCh5wL4czXUV0ym4OMlDE5BZ3N+hEpyAIOJmNV7jkNnMshMWfeN6puFZgwt/ FYt1BrU+MJ4PRA/A3B01ic3VQFnHifCE1jF/ebfb7DwZafK6EO2Hf91MNgAic5Td Q4TvwnHOqAq1N0cZa+SKNsStVx5Yk4J0ovNeecdQA2xNVfnd7jLaU1Y57SHjxNi9 wbsENC3bTpZed+lMhDiBaRIj//Ej6KMeQKUNbcvPH5HCHP5YN68QFwkoA+QJdX66 SH7jvDI6xgjlvVoNjqZ6bYHDr+CK5AB7fLDXhEGWBIssjce8AeaNPPA7JHMsVCen o7WXri4Bb7W4BwfpicTPlumkF+vva+nKYWvuAfob7v2yayeCa8vPKgrEPHXbCnWa 8r1lqyQVqKL1wqS5RcpsHZEWrV2HF0hoKam4x3ZmLqNDhnVC0t8IipL0vqN+vzaU t26QZrpiW8V7CZRiXeCj5rDhv8Z1w+wEiuGLTqp9Z1JD/mCVy7Tmm2Y6RNYZw+jk lwpJpwqOpXbsCdx6kU28V8H1elS5cz3RdGCDex55lOlrMXp+KOs= =VoRh -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-01-22-2024-5 macOS Sonoma 14.3
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-5 macOS Sonoma 14.3 macOS Sonoma 14.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214061. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Apple Neural Engine Available for: macOS Sonoma Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23212: Ye Zhang of Baidu Security CoreCrypto Available for: macOS Sonoma Impact: An attacker may be able to decrypt legacy RSA PKCS#1 v1.5 ciphertexts without having the private key Description: A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. CVE-2024-23218: Clemens Lang Finder Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: The issue was addressed with improved checks. CVE-2024-23224: Brian McNulty Kernel Available for: macOS Sonoma Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23208: fmyy(@binary_fmyy) and lime From TIANGONG Team of Legendsec at QI-ANXIN Group LLVM Available for: macOS Sonoma Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. CVE-2024-23209 Mail Search Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23207: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab), and Ian de Marcellus NSSpellChecker Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved handling of files. CVE-2024-23223: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Safari Available for: macOS Sonoma Impact: A user's private browsing activity may be visible in Settings Description: A privacy issue was addressed with improved handling of user preferences. CVE-2024-23211: Mark Bowers Shortcuts Available for: macOS Sonoma Impact: A shortcut may be able to use sensitive data with certain actions without prompting the user Description: The issue was addressed with additional permissions checks. CVE-2024-23203: an anonymous researcher CVE-2024-23204: Jubaer Alnazi (@h33tjubaer) Shortcuts Available for: macOS Sonoma Impact: An app may be able to bypass certain Privacy preferences Description: A privacy issue was addressed with improved handling of temporary files. CVE-2024-23217: Kirin (@Pwnrin) TCC Available for: macOS Sonoma Impact: An app may be able to access user-sensitive data Description: An issue was addressed with improved handling of temporary files. CVE-2024-23215: Zhongquan Li (@Guluisacat) Time Zone Available for: macOS Sonoma Impact: An app may be able to view a user's phone number in system logs Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23210: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) WebKit Available for: macOS Sonoma Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 262699 CVE-2024-23206: an anonymous researcher WebKit Available for: macOS Sonoma Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 266619 CVE-2024-23213: Wangtaiyu of Zhongfu info WebKit Available for: macOS Sonoma Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. WebKit Bugzilla: 265129 CVE-2024-23214: Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute WebKit Available for: macOS Sonoma Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 267134 CVE-2024-23222 macOS Sonoma 14.3 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDgUACgkQX+5d1TXa Ivrf0Q/+Oca+geM2QXg9QR+6PJwuFfzuAMn2nm88bHWtJH6kaTe8Lc48OuFk6j0C Q9KoLCDG7JTya701wTgIfCnJEpS7J6JCHxao8qPujebjTFumhvwigwI0uZzD1H2r c5fJfQtlNAfG163ON26ZEbF7AMVL630illOUko0ULqYCiUM4qF/5h0zsPJgXjFHJ 4Yc5nMqH3jVjaAVxwNQhxU1L8Rz0xzOrNPX05FixPx9MTLZ6CuS8cRBYBv1HkLxm OIqc4QUuWngNdxQ+ZCEcnr6yg96VXg6S7gVRlLOcTLxDOzRADF0OpztLwtfksMKp gB7QllWloOIQ//NfWcNAX/TqmeKvOJ9kVTgRxz6MfwbnVkI9WfW3XQ1joowJ25r7 mn/X/bk3Bi+U3qTxxiAFi/Wlh2QfSnIwVmd0KWuFnbxs/5LyeGox+jDbRO1xKlfv tj1V1aMVBUqj3OIWBbdN/pOpgDhhPfKrdwHNcER/LuTitjXAOhDI60Jdi/6xQBgY S4d4duOjvEj7gY3EYJ5qrW/+2f/dNzMw6lsmPpckgKbUwKgqEaHadAEzpxkRZ1rm 4BOozvMt69WlhCOFEEyVky08opNCQg/uQj0Uegcm6zeEpv98xsk0a9NJMRI+Pjsw rdTAOkNCgTy0QROYO+/TympI2LEJkppw+TSbaYK1S+rLDMO9Cvo= =rPM0 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-01-22-2024-4 iOS 15.8.1 and iPadOS 15.8.1
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-4 iOS 15.8.1 and iPadOS 15.8.1 iOS 15.8.1 and iPadOS 15.8.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214062. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. WebKit Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation) Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: An out-of-bounds read was addressed with improved input validation. WebKit Bugzilla: 265041 CVE-2023-42916: Clément Lecigne of Google's Threat Analysis Group WebKit Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation) Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 265067 CVE-2023-42917: Clément Lecigne of Google's Threat Analysis Group This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 15.8.1 and iPadOS 15.8.1". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDd8ACgkQX+5d1TXa IvrnYQ//eEhI4dYnq+om+sw4N+fNEcTZWLtBe3GyWgzVtBuvWOwt0Z34BNfVD4jF z1YlzYp18bzYTCdThkIrvQSe/QmYEmdKt16RtQH3qJTyE18h2YLG31gA/ja8iPcN AdqQqz6tJEq9aUrmeyAhFNsEZX7PHVfuSigqi8495rMcN1xI6caCS7Tio98EVmNe 6cMRLUefSJH0z5GvwjbTgLCKbhv+/pDAq0L8Lqosy9CFS+oMRYyCdXoPL3E2wOpd nxVgjctp6YJrjT/LFdeT8e3gu6oOo/Pj+bx9RWP8vVS0jos5DXOJJAnLn3qOt9yS tqmECBpque3L3PrhToPdSCiIFE8JbHFBWscO/TaF3rQvmZfLSx+HKJR8VSAjpGTh jLHWAQUFUauoQ1TudmtA3y9rolCkvhMeZXvbi0dxkEgRtBCbJzRWfMQ6rPeOOkgU USBkVM/O55bhQ1JqmpUBq2s4lCx6EErwSm1XS6ooXxZt9FWltqhu+ixgne63X8U5 +cLJlkRWjeIC63pziGkB6RbIQkupEanrbH8ekRFQs4zIazq1fjZANRN71y+wAZZ5 tcbvH37FzUPT7HL9ZPMO8wvVVFEEHNx4RIB+KNSH2E/z67Jhs9nM1atUNg1djufg /mmAfx/83pQretb4xqiN6VKJdPCY/BXkWhBJbdWUpqsODUmfvY0= =wSSi -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-01-22-2024-3 iOS 16.7.5 and iPadOS 16.7.5
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-3 iOS 16.7.5 and iPadOS 16.7.5 iOS 16.7.5 and iPadOS 16.7.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214063. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Accessibility Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-42937: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Apple Neural Engine Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23212: Ye Zhang of Baidu Security curl Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: Multiple issues in curl Description: Multiple issues were addressed by updating to curl version 8.4.0. CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 CVE-2023-42915 ImageIO Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved checks. CVE-2023-42888: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Safari Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: A user's private browsing activity may be visible in Settings Description: A privacy issue was addressed with improved handling of user preferences. CVE-2024-23211: Mark Bowers WebKit Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 266619 CVE-2024-23213: Wangtaiyu of Zhongfu info WebKit Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. WebKit Bugzilla: 265129 CVE-2024-23214: Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute WebKit Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 262699 CVE-2024-23206: an anonymous researcher WebKit Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 267134 CVE-2024-23222 This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 16.7.5 and iPadOS 16.7.5". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDacACgkQX+5d1TXa IvpgXxAAvQ8KvvppTOQ/4HsWUyKkJyubBU+8sgfM/tKBbk/Lb2ABMGhzb/Ln68Bg 2GB23kOI5y0X6Gy9IZqAl8TY71baaxrgZQrz0uXMfdgzA1Gcf3mAP/mGyDYcKy2p BMwnuJQbO0dzZCcm0P069WDBW6jDwBJwzZ3f50LUCH8CgqNgdZ+ey+hMLfDEbamT tySwDXxL3ORgFoDY1X4ysxUlPGRqZhQ0vwWQ0cvcDFJyrP+Xy76V5XhP8/zEiAUm lzf6jVWjJq3DkkTKw1CamM5tvyc5Jm7tagOFZPaLi2k5no8YtjU7kKxXjTpsg+it T0p5yNJeCtKP6fZdRryT+t9tGUk0QjFjin8WUO0otqn3v+MI/ezn4YM8ioCzL5Yc N6rvm+9ta4Q5C5h9UoVF1KsM9Zs/e6f8nfF8aWRcrMTCR83TUhBoviSuWyvfxo5i DbNDws+ijuBKqEYHRrBnGMZSyyzFzfl5Nlf9HeEyslpJ0Jt0ta1i9IyYNlDotKo3 wDcvDQc3lIM4oeW/A3qt0lDqwfhz1M5Kf6I5LqY6YE5fCGg8YOBqSVtvH39BwDzT 2yVmJHeX6CpFEkR4tsGYN4HTKoo50SVQeAtPh4iaG4qLes2T5b/T18hEjaSfVsJO L4vHPIQiU1DqfQa5Fjn/HVUljPZPL5A+OsjYcs8z9nPbySIlWyE= =9qeR -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-01-22-2024-2 iOS 17.3 and iPadOS 17.3
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-2 iOS 17.3 and iPadOS 17.3 iOS 17.3 and iPadOS 17.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214059. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Apple Neural Engine Available for devices with Apple Neural Engine: iPhone XS and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23212: Ye Zhang of Baidu Security CoreCrypto Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An attacker may be able to decrypt legacy RSA PKCS#1 v1.5 ciphertexts without having the private key Description: A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. CVE-2024-23218: Clemens Lang Kernel Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23208: fmyy(@binary_fmyy) and lime From TIANGONG Team of Legendsec at QI-ANXIN Group Mail Search Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23207: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab), and Ian de Marcellus NSSpellChecker Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved handling of files. CVE-2024-23223: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Reset Services Available for: iPhone XS and later Impact: Stolen Device Protection may be unexpectedly disabled Description: The issue was addressed with improved authentication. CVE-2024-23219: Peter Watthey and Christian Scalese Safari Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: A user's private browsing activity may be visible in Settings Description: A privacy issue was addressed with improved handling of user preferences. CVE-2024-23211: Mark Bowers Shortcuts Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: A shortcut may be able to use sensitive data with certain actions without prompting the user Description: The issue was addressed with additional permissions checks. CVE-2024-23203: an anonymous researcher CVE-2024-23204: Jubaer Alnazi (@h33tjubaer) Shortcuts Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An app may be able to bypass certain Privacy preferences Description: A privacy issue was addressed with improved handling of temporary files. CVE-2024-23217: Kirin (@Pwnrin) TCC Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access user-sensitive data Description: An issue was addressed with improved handling of temporary files. CVE-2024-23215: Zhongquan Li (@Guluisacat) Time Zone Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An app may be able to view a user's phone number in system logs Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23210: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) WebKit Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 262699 CVE-2024-23206: an anonymous researcher WebKit Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 266619 CVE-2024-23213: Wangtaiyu of Zhongfu info WebKit Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. WebKit Bugzilla: 265129 CVE-2024-23214: Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute WebKit Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 267134 CVE-2024-23222 This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 17.3 and iPadOS 17.3". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDP8ACgkQX+5d1TXa Ivp1NA//Ziu4pKJd/OIbEjiPfVw8w/q2A4uPkHzOtxWWeSsuQHmUjULi9PGLtjFd Oy6SGjIAXKkP5wpt2qoOXcqEwP8kQzMQZwmRSHyPbSNXLyDiThgLdFWOqV5GcO1+ eM7vOvKfcf7ITJJashPS4gJet7QpqX0vM5Pop9XJlS679IdhnauCY/ocmoWafvay Y7IZf6SXYXh/V6wWk76zW7ZAgdWz0qxPjoObc3UrggJagBuBGzbSbEj1aK+tw8GM Kw0whSG1fMqoLWsIielGaAahHmyIrg424S3HK/JdAXU8QXKKUc3HYVyShceLIgf7 Gn/RFtIFiqoAlublgbEXthPYVG+pwFMvjUiCFPZK4tQ9yDtst+6ViPT+LK8Ea21Z qwvWTYqcFzKVbc+DcA4W0sLZE9Rc3tMXm60qoy5x1T4tIOFGSotrjH0M8CthxaxS MxRusr4ejiczr5dbeq/4pjU5PevU/kZVIp0lA65WkznSqio/UxpJ9uD2Oh2C8ZKO HE/az3I3zD7Tll52RPWA201fvo9Q3bCL5JRd/ayXN+tVRuyACkLPcDgPMNB8Tdjo BrzFvJ8KRg9XHn9qJSsz/h15UJ/lwVOKBHmSP3H+VWBR/ts0oKcj+UQGmNSHtWNX vreC6ZbQi16JSK2wp0MvVWbFrWnwg0Ory4e5x5hHbrBEvvw0Qwk= =kOJs -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-01-22-2024-1 Safari 17.3
by Apple Product Security via Security-announce 23 Jan '24

23 Jan '24

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-1 Safari 17.3 Safari 17.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214056. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Safari Available for: macOS Monterey and macOS Ventura Impact: A user's private browsing activity may be visible in Settings Description: A privacy issue was addressed with improved handling of user preferences. CVE-2024-23211: Mark Bowers WebKit Available for: macOS Monterey and macOS Ventura Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 262699 CVE-2024-23206: an anonymous researcher WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 266619 CVE-2024-23213: Wangtaiyu of Zhongfu info WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 267134 CVE-2024-23222 Safari 17.3 may be obtained from the Mac App Store. All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDK4ACgkQX+5d1TXa IvpsdQ/+LRXsqQK9ZIXoBoXhj0w15DUKVrVfQr/jauI3pgxBZcuZeYiM0SyNnROH SXppIL9KGUaOxDm+RqggN4rVB/PFPBTfZ7NB42odpnyxswVe7ozTir09BaYGnwoo o+S2I8IN6Nn7ePV5wTXjmftUjNetk6J5iGQ4KboVPTPsNOuw+3r/nohjrYt2ERgq YFVAsBK0gOQwY1chnNxOqFghWtZCkYKIinYCc89KcYVwZ6WpFaQlqk++E1p1vd1C l4teK1uJv7thLkpneq9e3alb1qQCfX5XLpHX596uNrs0HXJYESQgwZgHmMqsssJa LOCTahxE39Oevjy9q5z+UzaIBK2SAULgmaMdnrRLDV8641hDsjVuYyCzVs5jMNOa +ty80EmEUiwcR/yuzbAmOgmdvuVuowdkGWR9pdhTWM9Co7PMdTRZLUiOsi4qUUPT HxqJ42o53gNWzJhINTyufVRDd2VTcOH8X+C/uEbwMF/LHO4scNnI/0n1SrRsUCKg msV7r3VheTGylX3KV/ivZiJq8agjheh/awRDQ1/1Lyd7yGb8tZSdP0iFrCgayB9d RgrVR7yyXd/SCQsjI2hGRzTMoTQhARsx78dXtf2LFxONZZOFIaYnupzLxHeX58kp lcN/OmgEb9w0t+/M9Lwn4kdvTZ/rbfF5+1BAI9VTuuAt9N+0fyk= =jmbL -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0