ID

VAR-202203-0153


CVE

CVE-2022-22599


TITLE

plural  Apple  Vulnerability in improper permission assignment for critical resources in the product

Trust: 0.8

sources: JVNDB: JVNDB-2022-008582

DESCRIPTION

Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 8.5, iOS 15.4 and iPadOS 15.4, macOS Big Sur 11.6.5, macOS Monterey 12.3. A person with physical access to a device may be able to use Siri to obtain some location information from the lock screen. plural Apple The product contains a vulnerability in improper permission assignment for critical resources.Information may be obtained. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-03-14-1 iOS 15.4 and iPadOS 15.4 iOS 15.4 and iPadOS 15.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213182. Accelerate Framework Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved state management. CVE-2022-22633: an anonymous researcher AppleAVD Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted image may lead to heap corruption Description: A memory corruption issue was addressed with improved validation. CVE-2022-22666: Marc Schoenefeld, Dr. rer. nat. AVEVideoEncoder Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved bounds checking. CVE-2022-22634: an anonymous researcher AVEVideoEncoder Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to gain elevated privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-22635: an anonymous researcher AVEVideoEncoder Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-22636: an anonymous researcher Cellular Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A person with physical access may be able to view and modify the carrier account information and settings from the lock screen Description: The GSMA authentication panel could be presented on the lock screen. The issue was resolved by requiring device unlock to interact with the GSMA authentication panel. CVE-2022-22652: Kağan Eğlence (linkedin.com/in/kaganeglence) CoreMedia Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An app may be able to learn information about the current camera view before being granted camera access Description: An issue with app access to camera metadata was addressed with improved logic. CVE-2022-22598: Will Blaschko of Team Quasko FaceTime Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A user may be able to bypass the Emergency SOS passcode prompt Description: This issue was addressed with improved checks. CVE-2022-22642: Yicong Ding (@AntonioDing) FaceTime Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A user may send audio and video in a FaceTime call without knowing that they have done so Description: This issue was addressed with improved checks. CVE-2022-22643: Sonali Luthar of the University of Virginia, Michael Liao of the University of Illinois at Urbana-Champaign, Rohan Pahwa of Rutgers University, and Bao Nguyen of the University of Florida GPU Drivers Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed with improved memory management. CVE-2022-22667: Justin Sherman of the University of Maryland, Baltimore County ImageIO Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2022-22611: Xingyu Jin of Google ImageIO Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted image may lead to heap corruption Description: A memory consumption issue was addressed with improved memory handling. CVE-2022-22612: Xingyu Jin of Google IOGPUFamily Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to gain elevated privileges Description: A use after free issue was addressed with improved memory management. CVE-2022-22641: Mohamed Ghannam (@_simo36) iTunes Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A malicious website may be able to access information about the user and their devices Description: A logic issue was addressed with improved restrictions. CVE-2022-22653: Aymeric Chaib of CERT Banque de France Kernel Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved validation. CVE-2022-22596: an anonymous researcher CVE-2022-22640: sqrtpwn Kernel Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-22613: Alex, an anonymous researcher Kernel Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed with improved memory management. CVE-2022-22614: an anonymous researcher CVE-2022-22615: an anonymous researcher Kernel Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved state management. CVE-2022-22632: Keegan Saunders Kernel Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A null pointer dereference was addressed with improved validation. CVE-2022-22638: derrek (@derrekr6) libarchive Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Multiple issues in libarchive Description: Multiple memory corruption issues existed in libarchive. CVE-2021-36976 Markup Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A person with physical access to an iOS device may be able to see sensitive information via keyboard suggestions Description: This issue was addressed with improved checks. CVE-2022-22622: Ingyu Lim (@_kanarena) MediaRemote Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A malicious application may be able to identify what other applications a user has installed Description: An access issue was addressed with improved access restrictions. CVE-2022-22670: Brandon Azad NetworkExtension Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: A logic issue was addressed with improved state management. CVE-2022-22659: an anonymous researcher Phone Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A user may be able to bypass the Emergency SOS passcode prompt Description: This issue was addressed with improved checks. CVE-2022-22618: Yicong Ding (@AntonioDing) Preferences Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A malicious application may be able to read other applications' settings Description: The issue was addressed with additional permissions checks. CVE-2022-22609: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) Sandbox Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A malicious application may be able to bypass certain Privacy preferences Description: The issue was addressed with improved permissions logic. CVE-2022-22600: Sudhakar Muthumani of Primefort Private Limited, Khiem Tran Siri Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A person with physical access to a device may be able to use Siri to obtain some location information from the lock screen Description: A permissions issue was addressed with improved validation. CVE-2022-22599: Andrew Goldberg of the University of Texas at Austin, McCombs School of Business (linkedin.com/andrew-goldberg/) SoftwareUpdate Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to gain elevated privileges Description: A logic issue was addressed with improved state management. CVE-2022-22639: Mickey (@patch1t) UIKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A person with physical access to an iOS device may be able to see sensitive information via keyboard suggestions Description: This issue was addressed with improved checks. CVE-2022-22621: Joey Hewitt VoiceOver Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A person with physical access to an iOS device may be able to access photos from the lock screen Description: An authentication issue was addressed with improved state management. CVE-2022-22671: videosdebarraquito WebKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A cookie management issue was addressed with improved state management. WebKit Bugzilla: 232748 CVE-2022-22662: Prakash (@1lastBr3ath) of Threat Nix WebKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing maliciously crafted web content may lead to code execution Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 232812 CVE-2022-22610: Quan Yin of Bigo Technology Live Client Team WebKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. WebKit Bugzilla: 233172 CVE-2022-22624: Kirin (@Pwnrin) of Tencent Security Xuanwu Lab WebKit Bugzilla: 234147 CVE-2022-22628: Kirin (@Pwnrin) of Tencent Security Xuanwu Lab WebKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. WebKit Bugzilla: 234966 CVE-2022-22629: Jeonghoon Shin at Theori working with Trend Micro Zero Day Initiative WebKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A malicious website may cause unexpected cross-origin behavior Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 235294 CVE-2022-22637: Tom McKee of Google Wi-Fi Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A malicious application may be able to leak sensitive user information Description: A logic issue was addressed with improved restrictions. CVE-2022-22668: MrPhil17 Additional recognition AirDrop We would like to acknowledge Omar Espino (omespino.com), Ron Masas of BreakPoint.sh for their assistance. Bluetooth We would like to acknowledge an anonymous researcher for their assistance. Music We would like to acknowledge Vishesh Balani of Urban Company for their assistance. Notes We would like to acknowledge Abhishek Bansal of Wipro Technologies for their assistance. Safari We would like to acknowledge Konstantin Darutkin of FingerprintJS (fingerprintjs.com) for their assistance. Shortcuts We would like to acknowledge Baibhav Anand Jha of Streamers Land for their assistance. Siri We would like to acknowledge an anonymous researcher for their assistance. syslog We would like to acknowledge Yonghwi Jin (@jinmo123) of Theori for their assistance. UIKit We would like to acknowledge Tim Shadel of Day Logger, Inc. for their assistance. Wallet We would like to acknowledge an anonymous researcher for their assistance. WebKit We would like to acknowledge Abdullah Md Shaleh for their assistance. WebKit Storage We would like to acknowledge Martin Bajanik of FingerprintJS for their assistance. WidgetKit We would like to acknowledge an anonymous researcher for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 15.4 and iPadOS 15.4". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmIv0TcACgkQeC9qKD1p rhj47A/+MzBA5K7GNgX0pmF5XTfPFtPjM28knSOslgaK2A6VgfKC6WS8QXVnq0WU VWvh8L7zSxBtJ9yXe/d+/zDV2XJflUTda7sRtusmVGsj4uUd3wqONpoh2bHdkSga NTZgEic+vEY0MMj5KrHJzbc3m4DL/dQ9KTpGpxdTztTc3C2j3baCR4ky73+iuoha iTxgx27zqgllL/+qDFpyCcfyOI/53kvJ4AP09/q0UKoJSajwcGTiF9GysLM+1IJD 0t+h7KQ+1v38zI2fYhiyH47c+JJN4PqeHL9DSj6f1RcVTwFUAeuv86fugz8ed/BZ wwp+U7rJ2RS4zU/1hiDu5LDqbo6VW6yIslVEU0Qmtbf2KcTekGRX/Jqp/kJyOguj IexhEcOY3ADsjJ7MMX7rFRLcBcUpWTE9UM15+O8z6n5XCI3yCZAjHj49LkCK60PM /Ay/rFia+MBwnGvs+gZFiO742HSHCh2++jdNYN648JaefqXr8Ym4HnfpNRC7bzMg +m16dur8gHpk7FKNaKRLCkfJGV0dqeGYrtrXGtxSTWWfXQ2Ty7boJ7VEnWclqqCf Bqg2gkaioNQ/tkmjfqhdqBd23DQCpiYPuLdp4nY4KuXOhX7dqAUCFWYfRK9MHqo5 2FcNIE6xQexHv+6SIPOXnejpPXoV5OEku0Y/11mz8/Myiy2Imvk= =/IfW -----END PGP SIGNATURE----- . Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". CVE-2022-22625: Mickey Jin (@patch1t) of Trend Micro AppleScript Available for: macOS Monterey Impact: An application may be able to read restricted memory Description: This issue was addressed with improved checks. CVE-2022-22648: an anonymous researcher AppleScript Available for: macOS Monterey Impact: Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2022-22597: Qi Sun and Robert Ai of Trend Micro BOM Available for: macOS Monterey Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks Description: This issue was addressed with improved checks. CVE-2022-22616: Ferdous Saljooki (@malwarezoo) and Jaron Bradley (@jbradley89) of Jamf Software, Mickey Jin (@patch1t) curl Available for: macOS Monterey Impact: Multiple issues in curl Description: Multiple issues were addressed by updating to curl version 7.79.1. CVE-2021-36976 Login Window Available for: macOS Monterey Impact: A person with access to a Mac may be able to bypass Login Window Description: This issue was addressed with improved checks. CVE-2022-22664: Brandon Perry of Atredis Partners NSSpellChecker Available for: macOS Monterey Impact: A malicious application may be able to access information about a user's contacts Description: A privacy issue existed in the handling of Contact cards. CVE-2022-22650: Wojciech Reguła (@_r3ggi) of SecuRing Safari Downloads Available for: macOS Monterey Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks Description: This issue was addressed with improved checks. CVE-2022-22639: Mickey Jin (@patch1t) System Preferences Available for: macOS Monterey Impact: An app may be able to spoof system notifications and UI Description: This issue was addressed with a new entitlement. CVE-2022-22621: Joey Hewitt Vim Available for: macOS Monterey Impact: Multiple issues in Vim Description: Multiple issues were addressed by updating Vim. CVE-2021-4136 CVE-2021-4166 CVE-2021-4173 CVE-2021-4187 CVE-2021-4192 CVE-2021-4193 CVE-2021-46059 CVE-2022-0128 CVE-2022-0156 CVE-2022-0158 VoiceOver Available for: macOS Monterey Impact: A user may be able to view restricted content from the lock screen Description: A lock screen issue was addressed with improved state management. CVE-2022-22668: MrPhil17 xar Available for: macOS Monterey Impact: A local user may be able to write arbitrary files Description: A validation issue existed in the handling of symlinks. Intel Graphics Driver We would like to acknowledge Jack Dates of RET2 Systems, Inc., Yinyi Wu (@3ndy1) for their assistance. Password Manager We would like to acknowledge Maximilian Golla (@m33x) of Max Planck Institute for Security and Privacy (MPI-SP) for their assistance

Trust: 2.16

sources: NVD: CVE-2022-22599 // JVNDB: JVNDB-2022-008582 // VULHUB: VHN-411227 // VULMON: CVE-2022-22599 // PACKETSTORM: 166315 // PACKETSTORM: 166317 // PACKETSTORM: 166318 // PACKETSTORM: 166319

AFFECTED PRODUCTS

vendor:applemodel:macosscope:gteversion:12.0.0

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.6.5

Trust: 1.0

vendor:applemodel:macosscope:ltversion:12.3

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:15.4

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:8.5

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:15.4

Trust: 1.0

vendor:アップルmodel:watchosscope:eqversion:8.5

Trust: 0.8

vendor:アップルmodel:ipadosscope: - version: -

Trust: 0.8

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

vendor:アップルmodel:macosscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-008582 // NVD: CVE-2022-22599

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-22599
value: LOW

Trust: 1.0

NVD: CVE-2022-22599
value: LOW

Trust: 0.8

CNNVD: CNNVD-202203-1346
value: LOW

Trust: 0.6

VULHUB: VHN-411227
value: LOW

Trust: 0.1

VULMON: CVE-2022-22599
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2022-22599
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-411227
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-22599
baseSeverity: LOW
baseScore: 2.4
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 0.9
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2022-22599
baseSeverity: LOW
baseScore: 2.4
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-411227 // VULMON: CVE-2022-22599 // JVNDB: JVNDB-2022-008582 // CNNVD: CNNVD-202203-1346 // NVD: CVE-2022-22599

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Improper permission assignment for critical resources (CWE-732) [NVD evaluation ]

Trust: 0.8

problemtype:CWE-732

Trust: 0.1

sources: VULHUB: VHN-411227 // JVNDB: JVNDB-2022-008582 // NVD: CVE-2022-22599

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-202203-1346

PATCH

title:HT213184 Apple Security Updatesurl:https://support.apple.com/en-us/HT213182

Trust: 0.8

title:Apple iOS Fixes for permissions and access control issues vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=186384

Trust: 0.6

title:Apple: macOS Big Sur 11.6.5url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=4c90c4b83ae5b2687f4b5d9d71e49f12

Trust: 0.1

title:Apple: iOS 15.4 and iPadOS 15.4url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=14b60b166a667fc4faf52d81847a180a

Trust: 0.1

title:Apple: macOS Monterey 12.3url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=f1105c4a20da11497b610b14a1668180

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: VULMON: CVE-2022-22599 // JVNDB: JVNDB-2022-008582 // CNNVD: CNNVD-202203-1346

EXTERNAL IDS

db:NVDid:CVE-2022-22599

Trust: 3.8

db:PACKETSTORMid:166317

Trust: 0.8

db:PACKETSTORMid:166318

Trust: 0.8

db:JVNDBid:JVNDB-2022-008582

Trust: 0.8

db:CS-HELPid:SB2022031439

Trust: 0.6

db:CNNVDid:CNNVD-202203-1346

Trust: 0.6

db:PACKETSTORMid:166319

Trust: 0.2

db:PACKETSTORMid:166315

Trust: 0.2

db:VULHUBid:VHN-411227

Trust: 0.1

db:ICS CERTid:ICSA-23-012-03

Trust: 0.1

db:VULMONid:CVE-2022-22599

Trust: 0.1

sources: VULHUB: VHN-411227 // VULMON: CVE-2022-22599 // JVNDB: JVNDB-2022-008582 // PACKETSTORM: 166315 // PACKETSTORM: 166317 // PACKETSTORM: 166318 // PACKETSTORM: 166319 // CNNVD: CNNVD-202203-1346 // NVD: CVE-2022-22599

REFERENCES

url:https://support.apple.com/en-us/ht213182

Trust: 2.4

url:https://support.apple.com/en-us/ht213183

Trust: 1.8

url:https://support.apple.com/en-us/ht213184

Trust: 1.8

url:https://support.apple.com/en-us/ht213193

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-22599

Trust: 1.2

url:https://packetstormsecurity.com/files/166318/apple-security-advisory-2022-03-14-2.html

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-22599/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031439

Trust: 0.6

url:https://vigilance.fr/vulnerability/apple-ios-macos-multiple-vulnerabilities-37800

Trust: 0.6

url:https://packetstormsecurity.com/files/166317/apple-security-advisory-2022-03-14-1.html

Trust: 0.6

url:https://support.apple.com/en-us/ht201222.

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22613

Trust: 0.4

url:https://www.apple.com/support/security/pgp/

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22615

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22614

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22633

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22638

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22632

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22609

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22612

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22610

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22600

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-36976

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22611

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22616

Trust: 0.2

url:https://support.apple.com/downloads/

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22597

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22582

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22662

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22629

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22628

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22637

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22621

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22618

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22624

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22596

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22625

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22661

Trust: 0.1

url:https://support.apple.com/ht213184.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22650

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22617

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22626

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22631

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22627

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22647

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22648

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22656

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22634

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22622

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22636

Trust: 0.1

url:https://support.apple.com/ht213182.

Trust: 0.1

url:https://www.apple.com/itunes/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22598

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22635

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22639

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22670

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22666

Trust: 0.1

url:https://support.apple.com/kb/ht204641

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22654

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22640

Trust: 0.1

url:https://support.apple.com/ht213193.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4173

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4136

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4192

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-46059

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22945

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0156

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0158

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4193

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30918

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22947

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4166

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0128

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4187

Trust: 0.1

url:https://support.apple.com/ht213183.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22946

Trust: 0.1

sources: VULHUB: VHN-411227 // VULMON: CVE-2022-22599 // JVNDB: JVNDB-2022-008582 // PACKETSTORM: 166315 // PACKETSTORM: 166317 // PACKETSTORM: 166318 // PACKETSTORM: 166319 // CNNVD: CNNVD-202203-1346 // NVD: CVE-2022-22599

CREDITS

Apple

Trust: 0.4

sources: PACKETSTORM: 166315 // PACKETSTORM: 166317 // PACKETSTORM: 166318 // PACKETSTORM: 166319

SOURCES

db:VULHUBid:VHN-411227
db:VULMONid:CVE-2022-22599
db:JVNDBid:JVNDB-2022-008582
db:PACKETSTORMid:166315
db:PACKETSTORMid:166317
db:PACKETSTORMid:166318
db:PACKETSTORMid:166319
db:CNNVDid:CNNVD-202203-1346
db:NVDid:CVE-2022-22599

LAST UPDATE DATE

2024-08-14T13:14:07.252000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-411227date:2022-03-28T00:00:00
db:VULMONid:CVE-2022-22599date:2023-08-08T00:00:00
db:JVNDBid:JVNDB-2022-008582date:2023-07-28T04:59:00
db:CNNVDid:CNNVD-202203-1346date:2022-12-09T00:00:00
db:NVDid:CVE-2022-22599date:2023-08-08T14:22:24.967

SOURCES RELEASE DATE

db:VULHUBid:VHN-411227date:2022-03-18T00:00:00
db:VULMONid:CVE-2022-22599date:2022-03-18T00:00:00
db:JVNDBid:JVNDB-2022-008582date:2023-07-28T00:00:00
db:PACKETSTORMid:166315date:2022-03-15T15:46:38
db:PACKETSTORMid:166317date:2022-03-15T15:47:31
db:PACKETSTORMid:166318date:2022-03-15T15:48:26
db:PACKETSTORMid:166319date:2022-03-15T15:49:02
db:CNNVDid:CNNVD-202203-1346date:2022-03-14T00:00:00
db:NVDid:CVE-2022-22599date:2022-03-18T18:15:13.013