site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-12-11-2023-6 macOS Monterey 12.7.2 macOS Monterey 12.7.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214037. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Accounts Available for: macOS Monterey Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-42919: Kirin (@Pwnrin) AppleEvents Available for: macOS Monterey Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved redaction of sensitive information. CVE-2023-42894: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) CoreServices Available for: macOS Monterey Impact: A user may be able to cause unexpected app termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2023-42886: Koh M. Nakagawa (@tsunek0h) Find My Available for: macOS Monterey Impact: An app may be able to read sensitive location information Description: This issue was addressed with improved redaction of sensitive information. CVE-2023-42922: Wojciech Regula of SecuRing (wojciechregula.blog) ImageIO Available for: macOS Monterey Impact: Processing an image may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. CVE-2023-42899: Meysam Firouzi @R00tkitSMM and Junsung Lee IOKit Available for: macOS Monterey Impact: An app may be able to monitor keystrokes without user permission Description: An authentication issue was addressed with improved state management. CVE-2023-42891: an anonymous researcher Kernel Available for: macOS Monterey Impact: An app may be able to break out of its sandbox Description: The issue was addressed with improved memory handling. CVE-2023-42914: Eloi Benoist-Vanderbeken (@elvanderb) of Synacktiv (@Synacktiv) ncurses Available for: macOS Monterey Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2020-19185 CVE-2020-19186 CVE-2020-19187 CVE-2020-19188 CVE-2020-19189 CVE-2020-19190 TCC Available for: macOS Monterey Impact: An app may be able to access protected user data Description: A logic issue was addressed with improved checks. CVE-2023-42932: Zhongquan Li (@Guluisacat) Vim Available for: macOS Monterey Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: This issue was addressed by updating to Vim version 9.0.1969. CVE-2023-5344 macOS Monterey 12.7.2 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmV3qkgACgkQX+5d1TXa Ivoi6g//deAGIBiNGJ9/O+WaHdMoxgvKz0DltheGcMXYTOlrO8KnGTDQocG6kGKs V+p4CNnyBCxMXz8jIVxaOE2httkTxv9YTXRZ9i4CmeK1OGlWNgslqdRSx4f/4D8G 7S2NbyIWqXjn/S36Lr8ueApGbnojUYfDcORwcpGgbNGF22hQjepcivIt7hscdFfw OaNZ4Z6BgBiA6kEDeZ3arsfMwCbj5dZLSi1tcgwfngZcqKAQgZu9gWKaveZYXAdS yabpr+MBuw/qVII7FJU0o8Vr8uMoDiUjNrrP8se4LPYo9TIl71CWGXsVZk2vHosj lIVFdu5PmZ5fAoCcUKaZHo8U5uaq23QgtuQefDU5t5vtKlEBN+oHxWfMHyJ3Z1RC hdUBd7huNkOVwh+X2h/kpUZA064udVyZNSLTTZGI0BdEZan3HGAw0/rCtZiESE6C LMy+UIs/EgnFalxQwRtPAzTippWf+J8LKpw0Iq+VqOOslA0YrBnbkVfSyq0YK7D8 tNLCdpvZKa582DTscNoWzoDMxWDDMf1vO09Aqklq6iS08vMLHZejWQTjkHS3jF5l wJP1l1al2/um29uKNjTNmfSkBm2YCLnO4750xo4r0488/BUf/BWSynPTT7H9NkLs rTcKnM14a4eBOArrJpueRA2fpgbvEuiqgu0INpZUTnEWF5r/QEY= =w28X -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com