ID

VAR-202204-1222

CVE

CVE-2022-29046

TITLE

Jenkins Subversion  Cross-site scripting vulnerability in plugins

DESCRIPTION

Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Jenkins Subversion A cross-site scripting vulnerability exists in the plugin.Information may be obtained and information may be tampered with. Jenkins is an open source application software of Jenkins. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: OpenShift Container Platform 3.11.705 security update Advisory ID: RHSA-2022:2280-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:2280 Issue date: 2022-05-31 CVE Names: CVE-2022-21698 CVE-2022-29036 CVE-2022-29046 ==================================================================== 1. Summary: Red Hat OpenShift Container Platform release 3.11.705 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Container Platform 3.11 - noarch, ppc64le, x86_64 3. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.705. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2022:2281 Security Fix(es): * credentials: Stored XSS vulnerabilities in jenkins plugin (CVE-2022-29036) * subversion: Stored XSS vulnerabilities in Jenkins subversion plugin (CVE-2022-29046) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section. All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/3.11/updating/updating-cluster-cli.html 4. Solution: Before applying this update, ensure all previously released errata relevant to your system is applied. For OpenShift Container Platform 3.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/3.11/upgrading/index.html 5. Bugs fixed (https://bugzilla.redhat.com/): 2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter 2069201 - during node scaleup sdn-pod crashloopback could not start DNS, unable to read config file: open /etc/origin/node/resolv.conf: no such file or directory 2071682 - sdn pod is crashing with panic: runtime error: invalid memory address or nil pointer dereference 2074847 - CVE-2022-29036 credentials: Stored XSS vulnerabilities in jenkins plugin 2074851 - CVE-2022-29046 subversion: Stored XSS vulnerabilities in Jenkins subversion plugin 6. Package List: Red Hat OpenShift Container Platform 3.11: Source: atomic-enterprise-service-catalog-3.11.705-1.g2e6be86.el7.src.rpm atomic-openshift-3.11.705-1.git.0.7a17a5d.el7.src.rpm atomic-openshift-cluster-autoscaler-3.11.705-1.g99b2acf.el7.src.rpm atomic-openshift-descheduler-3.11.705-1.gd435537.el7.src.rpm atomic-openshift-dockerregistry-3.11.705-1.g0fa231c.el7.src.rpm atomic-openshift-metrics-server-3.11.705-1.gf8bf728.el7.src.rpm atomic-openshift-node-problem-detector-3.11.705-1.gc8f26da.el7.src.rpm atomic-openshift-service-idler-3.11.705-1.g39cfc66.el7.src.rpm atomic-openshift-web-console-3.11.705-1.ge59c860.el7.src.rpm golang-github-openshift-oauth-proxy-3.11.705-1.gedebe84.el7.src.rpm golang-github-prometheus-alertmanager-3.11.705-1.g13de638.el7.src.rpm golang-github-prometheus-node_exporter-3.11.705-1.g609cd20.el7.src.rpm golang-github-prometheus-prometheus-3.11.705-1.g99aae51.el7.src.rpm jenkins-2-plugins-3.11.1650628887-1.el7.src.rpm openshift-ansible-3.11.705-1.git.0.ad19a48.el7.src.rpm openshift-enterprise-autoheal-3.11.705-1.gf2f435d.el7.src.rpm openshift-enterprise-cluster-capacity-3.11.705-1.g22be164.el7.src.rpm openshift-kuryr-3.11.705-1.g0c4bf66.el7.src.rpm noarch: atomic-openshift-docker-excluder-3.11.705-1.git.0.7a17a5d.el7.noarch.rpm atomic-openshift-excluder-3.11.705-1.git.0.7a17a5d.el7.noarch.rpm jenkins-2-plugins-3.11.1650628887-1.el7.noarch.rpm openshift-ansible-3.11.705-1.git.0.ad19a48.el7.noarch.rpm openshift-ansible-docs-3.11.705-1.git.0.ad19a48.el7.noarch.rpm openshift-ansible-playbooks-3.11.705-1.git.0.ad19a48.el7.noarch.rpm openshift-ansible-roles-3.11.705-1.git.0.ad19a48.el7.noarch.rpm openshift-ansible-test-3.11.705-1.git.0.ad19a48.el7.noarch.rpm openshift-kuryr-cni-3.11.705-1.g0c4bf66.el7.noarch.rpm openshift-kuryr-common-3.11.705-1.g0c4bf66.el7.noarch.rpm openshift-kuryr-controller-3.11.705-1.g0c4bf66.el7.noarch.rpm python2-kuryr-kubernetes-3.11.705-1.g0c4bf66.el7.noarch.rpm ppc64le: atomic-enterprise-service-catalog-3.11.705-1.g2e6be86.el7.ppc64le.rpm atomic-enterprise-service-catalog-svcat-3.11.705-1.g2e6be86.el7.ppc64le.rpm atomic-openshift-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-clients-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-cluster-autoscaler-3.11.705-1.g99b2acf.el7.ppc64le.rpm atomic-openshift-descheduler-3.11.705-1.gd435537.el7.ppc64le.rpm atomic-openshift-hyperkube-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-hypershift-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-master-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-metrics-server-3.11.705-1.gf8bf728.el7.ppc64le.rpm atomic-openshift-node-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-node-problem-detector-3.11.705-1.gc8f26da.el7.ppc64le.rpm atomic-openshift-pod-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-sdn-ovs-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-service-idler-3.11.705-1.g39cfc66.el7.ppc64le.rpm atomic-openshift-template-service-broker-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-tests-3.11.705-1.git.0.7a17a5d.el7.ppc64le.rpm atomic-openshift-web-console-3.11.705-1.ge59c860.el7.ppc64le.rpm golang-github-openshift-oauth-proxy-3.11.705-1.gedebe84.el7.ppc64le.rpm openshift-enterprise-autoheal-3.11.705-1.gf2f435d.el7.ppc64le.rpm openshift-enterprise-cluster-capacity-3.11.705-1.g22be164.el7.ppc64le.rpm prometheus-3.11.705-1.g99aae51.el7.ppc64le.rpm prometheus-alertmanager-3.11.705-1.g13de638.el7.ppc64le.rpm prometheus-node-exporter-3.11.705-1.g609cd20.el7.ppc64le.rpm x86_64: atomic-enterprise-service-catalog-3.11.705-1.g2e6be86.el7.x86_64.rpm atomic-enterprise-service-catalog-svcat-3.11.705-1.g2e6be86.el7.x86_64.rpm atomic-openshift-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-clients-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-clients-redistributable-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-cluster-autoscaler-3.11.705-1.g99b2acf.el7.x86_64.rpm atomic-openshift-descheduler-3.11.705-1.gd435537.el7.x86_64.rpm atomic-openshift-dockerregistry-3.11.705-1.g0fa231c.el7.x86_64.rpm atomic-openshift-hyperkube-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-hypershift-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-master-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-metrics-server-3.11.705-1.gf8bf728.el7.x86_64.rpm atomic-openshift-node-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-node-problem-detector-3.11.705-1.gc8f26da.el7.x86_64.rpm atomic-openshift-pod-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-sdn-ovs-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-service-idler-3.11.705-1.g39cfc66.el7.x86_64.rpm atomic-openshift-template-service-broker-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-tests-3.11.705-1.git.0.7a17a5d.el7.x86_64.rpm atomic-openshift-web-console-3.11.705-1.ge59c860.el7.x86_64.rpm golang-github-openshift-oauth-proxy-3.11.705-1.gedebe84.el7.x86_64.rpm openshift-enterprise-autoheal-3.11.705-1.gf2f435d.el7.x86_64.rpm openshift-enterprise-cluster-capacity-3.11.705-1.g22be164.el7.x86_64.rpm prometheus-3.11.705-1.g99aae51.el7.x86_64.rpm prometheus-alertmanager-3.11.705-1.g13de638.el7.x86_64.rpm prometheus-node-exporter-3.11.705-1.g609cd20.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-21698 https://access.redhat.com/security/cve/CVE-2022-29036 https://access.redhat.com/security/cve/CVE-2022-29046 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. Bugs fixed (https://bugzilla.redhat.com/): 2076211 - CVE-2022-1677 openshift/router: route hijacking attack via crafted HAProxy configuration file 2086938 - Placeholder bug for OCP 3.11.z image release 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-07-20-2 macOS Monterey 12.5 macOS Monterey 12.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213345. APFS Available for: macOS Monterey Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-32832: Tommy Muir (@Muirey03) AppleMobileFileIntegrity Available for: macOS Monterey Impact: An app may be able to gain root privileges Description: An authorization issue was addressed with improved state management. CVE-2022-32826: Mickey Jin (@patch1t) of Trend Micro Apple Neural Engine Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-32810: Mohamed Ghannam (@_simo36) Apple Neural Engine Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: This issue was addressed with improved checks. CVE-2022-32840: Mohamed Ghannam (@_simo36) Apple Neural Engine Available for: macOS Monterey Impact: An app may be able to break out of its sandbox Description: This issue was addressed with improved checks. CVE-2022-32845: Mohamed Ghannam (@_simo36) AppleScript Available for: macOS Monterey Impact: Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory Description: This issue was addressed with improved checks. CVE-2022-32797: Mickey Jin (@patch1t), Ye Zhang (@co0py_Cat) of Baidu Security, Mickey Jin (@patch1t) of Trend Micro AppleScript Available for: macOS Monterey Impact: Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory Description: An out-of-bounds read issue was addressed with improved input validation. CVE-2022-32851: Ye Zhang (@co0py_Cat) of Baidu Security CVE-2022-32852: Ye Zhang (@co0py_Cat) of Baidu Security CVE-2022-32853: Ye Zhang (@co0py_Cat) of Baidu Security AppleScript Available for: macOS Monterey Impact: Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory Description: An out-of-bounds read issue was addressed with improved bounds checking. CVE-2022-32831: Ye Zhang (@co0py_Cat) of Baidu Security Audio Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2022-32820: an anonymous researcher Audio Available for: macOS Monterey Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2022-32825: John Aakerblom (@jaakerblom) Automation Available for: macOS Monterey Impact: An app may be able to bypass Privacy preferences Description: A logic issue was addressed with improved checks. CVE-2022-32789: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab Calendar Available for: macOS Monterey Impact: An app may be able to access sensitive user information Description: The issue was addressed with improved handling of caches. CVE-2022-32805: Csaba Fitzl (@theevilbit) of Offensive Security CoreMedia Available for: macOS Monterey Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2022-32828: Antonio Zekic (@antoniozekic) and John Aakerblom (@jaakerblom) CoreText Available for: macOS Monterey Impact: A remote user may cause an unexpected app termination or arbitrary code execution Description: The issue was addressed with improved bounds checks. CVE-2022-32839: STAR Labs (@starlabs_sg) File System Events Available for: macOS Monterey Impact: An app may be able to gain root privileges Description: A logic issue was addressed with improved state management. CVE-2022-32819: Joshua Mason of Mandiant GPU Drivers Available for: macOS Monterey Impact: An app may be able to disclose kernel memory Description: Multiple out-of-bounds write issues were addressed with improved bounds checking. CVE-2022-32793: an anonymous researcher GPU Drivers Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved validation. CVE-2022-32821: John Aakerblom (@jaakerblom) iCloud Photo Library Available for: macOS Monterey Impact: An app may be able to access sensitive user information Description: An information disclosure issue was addressed by removing the vulnerable code. CVE-2022-32849: Joshua Jones ICU Available for: macOS Monterey Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-32787: Dohyun Lee (@l33d0hyun) of SSD Secure Disclosure Labs & DNSLab, Korea Univ. ImageIO Available for: macOS Monterey Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2022-32841: hjy79425575 ImageIO Available for: macOS Monterey Impact: Processing an image may lead to a denial-of-service Description: A null pointer dereference was addressed with improved validation. CVE-2022-32785: Yiğit Can YILMAZ (@yilmazcanyigit) Intel Graphics Driver Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A memory corruption vulnerability was addressed with improved locking. CVE-2022-32811: ABC Research s.r.o Intel Graphics Driver Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-32812: Yinyi Wu (@3ndy1), ABC Research s.r.o. Kernel Available for: macOS Monterey Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-32813: Xinru Chi of Pangu Lab CVE-2022-32815: Xinru Chi of Pangu Lab Kernel Available for: macOS Monterey Impact: An app may be able to disclose kernel memory Description: An out-of-bounds read issue was addressed with improved bounds checking. CVE-2022-32817: Xinru Chi of Pangu Lab Kernel Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: This issue was addressed with improved checks. CVE-2022-32829: an anonymous researcher Liblouis Available for: macOS Monterey Impact: An app may cause unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2022-26981: Hexhive (hexhive.epfl.ch), NCNIPC of China (nipc.org.cn) libxml2 Available for: macOS Monterey Impact: An app may be able to leak sensitive user information Description: A memory initialization issue was addressed with improved memory handling. CVE-2022-32823 Multi-Touch Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A type confusion issue was addressed with improved checks. CVE-2022-32814: Pan ZhenPeng (@Peterpan0927) Multi-Touch Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A type confusion issue was addressed with improved state handling. CVE-2022-32814: Pan ZhenPeng (@Peterpan0927) PackageKit Available for: macOS Monterey Impact: An app may be able to modify protected parts of the file system Description: An issue in the handling of environment variables was addressed with improved validation. CVE-2022-32786: Mickey Jin (@patch1t) PackageKit Available for: macOS Monterey Impact: An app may be able to modify protected parts of the file system Description: This issue was addressed with improved checks. CVE-2022-32800: Mickey Jin (@patch1t) PluginKit Available for: macOS Monterey Impact: An app may be able to read arbitrary files Description: A logic issue was addressed with improved state management. CVE-2022-32838: Mickey Jin (@patch1t) of Trend Micro PS Normalizer Available for: macOS Monterey Impact: Processing a maliciously crafted Postscript file may result in unexpected app termination or disclosure of process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-32843: Kai Lu of Zscaler's ThreatLabz SMB Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2022-32796: Sreejith Krishnan R (@skr0x1c0) SMB Available for: macOS Monterey Impact: An app may be able to gain elevated privileges Description: An out-of-bounds read issue was addressed with improved input validation. CVE-2022-32842: Sreejith Krishnan R (@skr0x1c0) SMB Available for: macOS Monterey Impact: An app may be able to gain elevated privileges Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2022-32798: Sreejith Krishnan R (@skr0x1c0) SMB Available for: macOS Monterey Impact: A user in a privileged network position may be able to leak sensitive information Description: An out-of-bounds read issue was addressed with improved bounds checking. CVE-2022-32799: Sreejith Krishnan R (@skr0x1c0) SMB Available for: macOS Monterey Impact: An app may be able to leak sensitive kernel state Description: The issue was addressed with improved memory handling. CVE-2022-32818: Sreejith Krishnan R (@skr0x1c0) Software Update Available for: macOS Monterey Impact: A user in a privileged network position can track a user’s activity Description: This issue was addressed by using HTTPS when sending information over the network. CVE-2022-32857: Jeffrey Paul (sneak.berlin) Spindump Available for: macOS Monterey Impact: An app may be able to overwrite arbitrary files Description: This issue was addressed with improved file handling. CVE-2022-32807: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab Spotlight Available for: macOS Monterey Impact: An app may be able to gain root privileges Description: This issue was addressed with improved checks. CVE-2022-32801: Joshua Mason (@josh@jhu.edu) subversion Available for: macOS Monterey Impact: Multiple issues in subversion Description: Multiple issues were addressed by updating subversion. CVE-2021-28544: Evgeny Kotkov, visualsvn.com CVE-2022-24070: Evgeny Kotkov, visualsvn.com CVE-2022-29046: Evgeny Kotkov, visualsvn.com CVE-2022-29048: Evgeny Kotkov, visualsvn.com TCC Available for: macOS Monterey Impact: An app may be able to access sensitive user information Description: An access issue was addressed with improvements to the sandbox. CVE-2022-32834: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) WebKit Available for: macOS Monterey Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: The issue was addressed with improved UI handling. WebKit Bugzilla: 239316 CVE-2022-32816: Dohyun Lee (@l33d0hyun) of SSD Secure Disclosure Labs & DNSLab, Korea Univ. WebKit Available for: macOS Monterey Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved input validation. WebKit Bugzilla: 240720 CVE-2022-32792: Manfred Paul (@_manfp) working with Trend Micro Zero Day Initiative WebRTC Available for: macOS Monterey Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 242339 CVE-2022-2294: Jan Vojtesek of Avast Threat Intelligence team Wi-Fi Available for: macOS Monterey Impact: An app may be able to cause unexpected system termination or write kernel memory Description: This issue was addressed with improved checks. CVE-2022-32837: Wang Yu of Cyberserval Wi-Fi Available for: macOS Monterey Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: This issue was addressed with improved checks. CVE-2022-32847: Wang Yu of Cyberserval Windows Server Available for: macOS Monterey Impact: An app may be able to capture a user’s screen Description: A logic issue was addressed with improved checks. CVE-2022-32848: Jeremy Legendre of MacEnhance Additional recognition 802.1X We would like to acknowledge Shin Sun of National Taiwan University for their assistance. AppleMobileFileIntegrity We would like to acknowledge Csaba Fitzl (@theevilbit) of Offensive Security, Mickey Jin (@patch1t) of Trend Micro, and Wojciech Reguła (@_r3ggi) of SecuRing for their assistance. Calendar We would like to acknowledge Joshua Jones for their assistance. configd We would like to acknowledge Csaba Fitzl (@theevilbit) of Offensive Security, Mickey Jin (@patch1t) of Trend Micro, and Wojciech Reguła (@_r3ggi) of SecuRing for their assistance. DiskArbitration We would like to acknowledge Mike Cush for their assistance. macOS Monterey 12.5 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmLYiL4ACgkQeC9qKD1p rhhjpQ//TQX1ihtXRIjFpPOViMy6IxuLE1CsKFxq5MweXelbPB/UdeUl/zL5G54b /Lx2XYKoWj6u27FCO0BHxBqtYbAd6sfx70VLCk5W6gyk/yCi0n3zh7BvRvWB/Ugh 6NuHB39a1kbbjLLoQPbW0L6egdrCfqP/+ZujqjKl7xI58nda9jMHJC1ns87KQoDn Er5SAGf7M2ErGNzOFqvXjpJYvGsrKJyfqNxp99H/sPlzu7URX9Gq3f3n1o55IUUa mcxlBPDfUmDQPjdSqw/BprQkDOvp0fzmTy+phB0fkgmvVJ8EmEJAoilL4SyH4uW9 V1GD9rtjUKh7G/gSFAo7y0HBDQoM+E9hA+4PPlH2o1nUOAl6BRWUka6jf4yaqrpr pfo1K2hPQj1g4MMZFCDWkJ+7V1+1GTQ9WlagL5gB3QaKefiSG4cTnL06Y8zn38TD TY3JrdqUI7Pzugu+FuHs7P168yNIGXTscb1ptrVlaVBaVuyICmEcKX4HS+I5o30q WqCOaRoaa6WRqBwNEy7zVAExjSPt7t8ZWt85avWSt+rLxNGiVkPrpHu4fE+V2IAV fz1VA4S/w69h9uJHXdcG+QfvNxX+zj/vljF6DK3dyQ957Mqfyr2y9ojSbdf6vo4n DJFXNxbEk35loy/kDDidC1C1sFKY+JeQF7ZBi0/QOyuSdSdJrSg= =ibIr -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

xss

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2024-11-23T20:08:56.851000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE