site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-22-2024-5 macOS Sonoma 14.3 macOS Sonoma 14.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214061. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Apple Neural Engine Available for: macOS Sonoma Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23212: Ye Zhang of Baidu Security CoreCrypto Available for: macOS Sonoma Impact: An attacker may be able to decrypt legacy RSA PKCS#1 v1.5 ciphertexts without having the private key Description: A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. CVE-2024-23218: Clemens Lang Finder Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: The issue was addressed with improved checks. CVE-2024-23224: Brian McNulty Kernel Available for: macOS Sonoma Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23208: fmyy(@binary_fmyy) and lime From TIANGONG Team of Legendsec at QI-ANXIN Group LLVM Available for: macOS Sonoma Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. CVE-2024-23209 Mail Search Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23207: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab), and Ian de Marcellus NSSpellChecker Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved handling of files. CVE-2024-23223: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Safari Available for: macOS Sonoma Impact: A user's private browsing activity may be visible in Settings Description: A privacy issue was addressed with improved handling of user preferences. CVE-2024-23211: Mark Bowers Shortcuts Available for: macOS Sonoma Impact: A shortcut may be able to use sensitive data with certain actions without prompting the user Description: The issue was addressed with additional permissions checks. CVE-2024-23203: an anonymous researcher CVE-2024-23204: Jubaer Alnazi (@h33tjubaer) Shortcuts Available for: macOS Sonoma Impact: An app may be able to bypass certain Privacy preferences Description: A privacy issue was addressed with improved handling of temporary files. CVE-2024-23217: Kirin (@Pwnrin) TCC Available for: macOS Sonoma Impact: An app may be able to access user-sensitive data Description: An issue was addressed with improved handling of temporary files. CVE-2024-23215: Zhongquan Li (@Guluisacat) Time Zone Available for: macOS Sonoma Impact: An app may be able to view a user's phone number in system logs Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-23210: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) WebKit Available for: macOS Sonoma Impact: A maliciously crafted webpage may be able to fingerprint the user Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 262699 CVE-2024-23206: an anonymous researcher WebKit Available for: macOS Sonoma Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 266619 CVE-2024-23213: Wangtaiyu of Zhongfu info WebKit Available for: macOS Sonoma Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. WebKit Bugzilla: 265129 CVE-2024-23214: Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute WebKit Available for: macOS Sonoma Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 267134 CVE-2024-23222 macOS Sonoma 14.3 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDgUACgkQX+5d1TXa Ivrf0Q/+Oca+geM2QXg9QR+6PJwuFfzuAMn2nm88bHWtJH6kaTe8Lc48OuFk6j0C Q9KoLCDG7JTya701wTgIfCnJEpS7J6JCHxao8qPujebjTFumhvwigwI0uZzD1H2r c5fJfQtlNAfG163ON26ZEbF7AMVL630illOUko0ULqYCiUM4qF/5h0zsPJgXjFHJ 4Yc5nMqH3jVjaAVxwNQhxU1L8Rz0xzOrNPX05FixPx9MTLZ6CuS8cRBYBv1HkLxm OIqc4QUuWngNdxQ+ZCEcnr6yg96VXg6S7gVRlLOcTLxDOzRADF0OpztLwtfksMKp gB7QllWloOIQ//NfWcNAX/TqmeKvOJ9kVTgRxz6MfwbnVkI9WfW3XQ1joowJ25r7 mn/X/bk3Bi+U3qTxxiAFi/Wlh2QfSnIwVmd0KWuFnbxs/5LyeGox+jDbRO1xKlfv tj1V1aMVBUqj3OIWBbdN/pOpgDhhPfKrdwHNcER/LuTitjXAOhDI60Jdi/6xQBgY S4d4duOjvEj7gY3EYJ5qrW/+2f/dNzMw6lsmPpckgKbUwKgqEaHadAEzpxkRZ1rm 4BOozvMt69WlhCOFEEyVky08opNCQg/uQj0Uegcm6zeEpv98xsk0a9NJMRI+Pjsw rdTAOkNCgTy0QROYO+/TympI2LEJkppw+TSbaYK1S+rLDMO9Cvo= =rPM0 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com