-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-12-13-6 macOS Big Sur 11.7.2 macOS Big Sur 11.7.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213534. BOM Available for: macOS Big Sur Impact: An app may bypass Gatekeeper checks Description: A logic issue was addressed with improved checks. CVE-2022-42821: Jonathan Bar Or of Microsoft DriverKit Available for: macOS Big Sur Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-32942: Linus Henze of Pinauten GmbH (pinauten.de) IOHIDFamily Available for: macOS Big Sur Impact: An app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state handling. CVE-2022-42864: Tommy Muir (@Muirey03) Kernel Available for: macOS Big Sur Impact: An app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with additional validation. CVE-2022-46689: Ian Beer of Google Project Zero Kernel Available for: macOS Big Sur Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-42845: Adam Doupé of ASU SEFCOM Kernel Available for: macOS Big Sur Impact: A remote user may be able to cause kernel code execution Description: The issue was addressed with improved memory handling. CVE-2022-42842: pattern-f (@pattern_F_) of Ant Security Light-Year Lab libxml2 Available for: macOS Big Sur Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: An integer overflow was addressed through improved input validation. CVE-2022-40303: Maddie Stone of Google Project Zero libxml2 Available for: macOS Big Sur Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2022-40304: Ned Williamson and Nathan Wachholz of Google Project Zero ppp Available for: macOS Big Sur Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-42840: an anonymous researcher xar Available for: macOS Big Sur Impact: Processing a maliciously crafted package may lead to arbitrary code execution Description: A type confusion issue was addressed with improved checks. CVE-2022-42841: Thijs Alkemade (@xnyhps) of Computest Sector 7 macOS Big Sur 11.7.2 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmOZFX8ACgkQ4RjMIDke NxkRHhAAks97Igh9fqeJEOOZuhjhTyUVSE7EVIDdqHx/YUX7BHIWbloEPHRFkkVH Sk1b94874939VVbt4yBnECvPhuCctdtejYapZRiIJhmNTcFUUXhXeBDUU8Gf5dG5 80fRmuFL18HSKpNQSnC6ExO+6a1J5l+B9ifLWgqi18YkbyCkqwsdob6q0IpIgs2G JzqvhfNAjF9fdDIui8rbIBqXM/Ak/N09k4QIqEMkyMIAucIh5YebKNgBSP5jH/tF dXIcZb4TKV0KblQRLSCvvHYDYmNB6A1uVeoTgsvWg6x3DQTNLN7sq6CJX4llInJP g3eZA6vv5LkxOm18RqgbyzknyMWkhfrJKf304oHNym47qw4pGBDvC6AQwZDFOdTw 60fDz+8weKRKNVCSEUAOEePrHcqV/9VdyNbnyxYDYr7DlVS4h4Yls+VD3Fn1pmkF f2+9CEGJe3cyzm7HO1pM8+seTvnYGPkSugaaEBxeUA1t3Q8alQEIgR4gXJwUqjKw vUVfdwVRN8S/UJ9XiAg93EKbi/kwSZ9RC4F8EPVsal/tKMMmawJDzHCJgA8ZyzGZ ODXpLQPPOs112BuyrtjLbMTQe7ZL+HKH4i1dwUqEbPYLsioBPqdKkwHynXXZpMGc 6vwn45KYrP3A98IH8U8rngxinRtRFZiwcF7/gZdYlty+wg+bl4k= =OFIf -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/rcloke%40apple.com This email sent to rcloke@apple.com