site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-12-11-2023-5 macOS Ventura 13.6.3 macOS Ventura 13.6.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214038. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Accounts Available for: macOS Ventura Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-42919: Kirin (@Pwnrin) AppleEvents Available for: macOS Ventura Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved redaction of sensitive information. CVE-2023-42894: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Archive Utility Available for: macOS Ventura Impact: An app may be able to access sensitive user data Description: A logic issue was addressed with improved checks. CVE-2023-42924: Mickey Jin (@patch1t) AVEVideoEncoder Available for: macOS Ventura Impact: An app may be able to disclose kernel memory Description: This issue was addressed with improved redaction of sensitive information. CVE-2023-42884: an anonymous researcher CoreServices Available for: macOS Ventura Impact: A user may be able to cause unexpected app termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2023-42886: Koh M. Nakagawa (@tsunek0h) Find My Available for: macOS Ventura Impact: An app may be able to read sensitive location information Description: This issue was addressed with improved redaction of sensitive information. CVE-2023-42922: Wojciech Regula of SecuRing (wojciechregula.blog) ImageIO Available for: macOS Ventura Impact: Processing an image may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. CVE-2023-42899: Meysam Firouzi @R00tkitSMM and Junsung Lee IOKit Available for: macOS Ventura Impact: An app may be able to monitor keystrokes without user permission Description: An authentication issue was addressed with improved state management. CVE-2023-42891: an anonymous researcher Kernel Available for: macOS Ventura Impact: An app may be able to break out of its sandbox Description: The issue was addressed with improved memory handling. CVE-2023-42914: Eloi Benoist-Vanderbeken (@elvanderb) of Synacktiv (@Synacktiv) ncurses Available for: macOS Ventura Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2020-19185 CVE-2020-19186 CVE-2020-19187 CVE-2020-19188 CVE-2020-19189 CVE-2020-19190 TCC Available for: macOS Ventura Impact: An app may be able to access protected user data Description: A logic issue was addressed with improved checks. CVE-2023-42932: Zhongquan Li (@Guluisacat) Vim Available for: macOS Ventura Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: This issue was addressed by updating to Vim version 9.0.1969. CVE-2023-5344 macOS Ventura 13.6.3 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmV3qgoACgkQX+5d1TXa IvpDVg//XCF9zB8zPCD2GtLafeKaQG1RY1ywmunkYsqnfzyOqkYb5MnbwozHMDwa qypd87nhWD7ROenEAUKf4yCjk9Gf168PeUEE5pYT7Hz4/bAfCVadOouy00/WBTEQ smmVQs0dYrPIJ1FW/ppx4SgXnXgLh9sSibwnn0nwd0cwsP8fkfbv3LLgqa8Ac7dB wcQoulwdau7SCdMXqNdch4iX91cH1qhSl1B8M6JmZNgg6iqCtCwBT1igzBGAijrb wv80jtTsvDxNjXn81Z4OpwhhIvcat4ZcV/caisRyK56co5v2BWm2rmQJwB8MQLVq M3Rjh8FeSg31t1BOCeKZh27tbihPE+TF/PBDHMOFW4n5PbyYe45ipVSiZtCJTx/M BzJiNsNsb4ej7TJUucPiLFNb2qRMS9NNu9/tnhCYzoSnuWd3ifxYJnF+sVJweZcl mJbIqXAPpopd9hvLr+ZLaVszbwCgDpj2D3puZ718x94JenipTRVAiBLlIJNZo7MC RKtHp357of0yaGfj8Ak8hkbU+MGxh5/l0fWIGEjCnqz8UP9xJ32PCpNU9hVLjFPF DJO4TdF4XBnTncCfXZMXdGouwutyab8DZBtq9Y5Xlvy6qSs9ljc4xBPvpspFsyRV xKYkmdMsZPZ02HSPKNZLEljeUEuHirrdMKNT0E+Kb3s6gwI7nGQ= =pTTV -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com