site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-09-26-2023-4 Additional information for APPLE-SA-2023-09-21-6 macOS Ventura 13.6 macOS Ventura 13.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213931. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Apple Neural Engine Available for: macOS Ventura Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2023-40412: Mohamed GHANNAM (@_simo36) CVE-2023-40409: Ye Zhang (@VAR10CK) of Baidu Security Entry added September 26, 2023 Apple Neural Engine Available for: macOS Ventura Impact: An app may be able to execute arbitrary code with kernel privileges Description: A use-after-free issue was addressed with improved memory management. CVE-2023-41071: Mohamed GHANNAM (@_simo36) Entry added September 26, 2023 Apple Neural Engine Available for: macOS Ventura Impact: An app may be able to disclose kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2023-40410: Tim Michaud (@TimGMichaud) of Moveworks.ai Entry added September 26, 2023 Biometric Authentication Available for: macOS Ventura Impact: An app may be able to disclose kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2023-41232: Liang Wei of PixiePoint Security Entry added September 26, 2023 ColorSync Available for: macOS Ventura Impact: An app may be able to read arbitrary files Description: The issue was addressed with improved checks. CVE-2023-40406: JeongOhKyea of Theori Entry added September 26, 2023 CoreAnimation Available for: macOS Ventura Impact: Processing web content may lead to a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2023-40420: 이준성(Junsung Lee) of Cross Republic Entry added September 26, 2023 Kernel Available for: macOS Ventura Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2023-41984: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Entry added September 26, 2023 Kernel Available for: macOS Ventura Impact: An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations Description: The issue was addressed with improved memory handling. CVE-2023-41981: Linus Henze of Pinauten GmbH (pinauten.de) Entry added September 26, 2023 Kernel Available for: macOS Ventura Impact: A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7. Description: The issue was addressed with improved checks. CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group libxpc Available for: macOS Ventura Impact: An app may be able to access protected user data Description: An authorization issue was addressed with improved state management. CVE-2023-41073: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (xlab.tencent.com) Entry added September 26, 2023 libxpc Available for: macOS Ventura Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with additional restrictions. CVE-2023-40454: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (xlab.tencent.com) Entry added September 26, 2023 libxslt Available for: macOS Ventura Impact: Processing web content may disclose sensitive information Description: The issue was addressed with improved memory handling. CVE-2023-40403: Dohyun Lee (@l33d0hyun) of PK Security Entry added September 26, 2023 Maps Available for: macOS Ventura Impact: An app may be able to read sensitive location information Description: The issue was addressed with improved handling of caches. CVE-2023-40427: Adam M., and Wojciech Regula of SecuRing (wojciechregula.blog) Entry added September 26, 2023 Pro Res Available for: macOS Ventura Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2023-41063: Certik Skyfall Team Entry added September 26, 2023 Sandbox Available for: macOS Ventura Impact: An app may be able to overwrite arbitrary files Description: The issue was addressed with improved bounds checks. CVE-2023-40452: Yiğit Can YILMAZ (@yilmazcanyigit) Entry added September 26, 2023 Sandbox Available for: macOS Ventura Impact: Apps that fail verification checks may still launch Description: The issue was addressed with improved checks. CVE-2023-41996: Yiğit Can YILMAZ (@yilmazcanyigit) and Mickey Jin (@patch1t) Entry added September 26, 2023 Security Available for: macOS Ventura Impact: A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7. Description: A certificate validation issue was addressed. CVE-2023-41991: Bill Marczak of The Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group Share Sheet Available for: macOS Ventura Impact: An app may be able to access sensitive data logged when a user shares a link Description: A logic issue was addressed with improved checks. CVE-2023-41070: Kirin (@Pwnrin) Entry added September 26, 2023 StorageKit Available for: macOS Ventura Impact: An app may be able to read arbitrary files Description: This issue was addressed with improved validation of symlinks. CVE-2023-41968: Mickey Jin (@patch1t), James Hutchins Entry added September 26, 2023 Additional recognition AppSandbox We would like to acknowledge Kirin (@Pwnrin) for their assistance. Entry added September 26, 2023 Kernel We would like to acknowledge Bill Marczak of The Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group for their assistance. libxml2 We would like to acknowledge OSS-Fuzz, and Ned Williamson of Google Project Zero for their assistance. Entry added September 26, 2023 WebKit We would like to acknowledge Khiem Tran, and Narendra Bhati From Suma Soft Pvt. Ltd, Pune (India) for their assistance. Entry added September 26, 2023 WebRTC We would like to acknowledge anonymous researcher for their assistance. Entry added September 26, 2023 macOS Ventura 13.6 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJcACgkQX+5d1TXa Ivrutw/+Ol5wjstHEfGsIssJnU3b7HQCOvYrKn1SS6tZSVfh7AGB3wsqAn5RWSef bPnbHweF7/RFr87JIQcC0I/4gndXoLue4C0yr5zOS1QvH4F/WgUgoOgrJwMg0EfK vLWivfNuQyYPgmcmY9wQSJoaV+Rtty6v+EcefPWKMudWJ106javKmJM91TAaKYlv t+IRVudrG7ZElxIIMKRdwICbhx/AFpCApRIzkYj+pMLMnPyOtxg40Qa+a8bteM0q Yc2Q/muAfDDJfgKUPGDh6OlnGsz9ThcxwTVwy7dlC4ekGRjTReQ4iMBpw/vJhWjV SpheUsyNnmuPnOT79FpZN1OwWSlgogtmPdgjKhzoHBpoV9hHf1d3ZP/7kQY1E3NC OBIG7Jl2Yf/g3ynsL/fVW60c833d2HGGiXfF+OW4D11XF73fovh1qPUMTGHV67m+ hnuSJEEVZBbRH0sicxCAlAT1IN3JW91wgSxGvAVQ3D83uARvqJJHPjr0GU4jbXBK GkZlI6/ATOT9vYRtlRL1oXKMsl9Mz+WUYGqjhtGJhxHSAz/I4nNTN/HIb0aoEOqo 7mi86X2Etc+3jy2Y5Injqbyqre+Jybg2JiO+DggHhTBV2y02yScxhWGroO3dmJpL bEcR+YXsUs51E6fcUYag6CVi9Bi4F5nXHVw9Bs8TXmR/IPfO4NQ= =FJcW -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com