Sign-up

ID

VAR-202205-1320


CVE

CVE-2022-26763


TITLE

plural  Apple  product   Buffer error vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-011442

DESCRIPTION

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious application may be able to execute arbitrary code with system privileges. plural Apple product Exists in a buffer error vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. macOS Monterey 12.4. Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-05-16-6 tvOS 15.5 tvOS 15.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213254. AppleAVD Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed with improved memory management. CVE-2022-26702: an anonymous researcher AppleAVD Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited. CVE-2022-22675: an anonymous researcher AuthKit Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A local user may be able to enable iCloud Photos without authentication Description: An authentication issue was addressed with improved state management. CVE-2022-26724: Jorge A. Caballero (@DataDrivenMD) AVEVideoEncoder Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-26736: an anonymous researcher CVE-2022-26737: an anonymous researcher CVE-2022-26738: an anonymous researcher CVE-2022-26739: an anonymous researcher CVE-2022-26740: an anonymous researcher DriverKit Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2022-26763: Linus Henze of Pinauten GmbH (pinauten.de) ImageIO Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2022-26711: actae0n of Blacksun Hackers Club working with Trend Micro Zero Day Initiative IOKit Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2022-26701: chenyuwang (@mzzzz__) of Tencent Security Xuanwu Lab IOMobileFrameBuffer Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2022-26768: an anonymous researcher IOSurfaceAccelerator Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2022-26771: an anonymous researcher Kernel Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved validation. CVE-2022-26714: Peter Nguyễn Vũ Hoàng (@peternguyen14) of STAR Labs (@starlabs_sg) Kernel Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed with improved memory management. CVE-2022-26757: Ned Williamson of Google Project Zero Kernel Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations Description: A memory corruption issue was addressed with improved validation. CVE-2022-26764: Linus Henze of Pinauten GmbH (pinauten.de) Kernel Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication Description: A race condition was addressed with improved state handling. CVE-2022-26765: Linus Henze of Pinauten GmbH (pinauten.de) LaunchServices Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: An access issue was addressed with additional sandbox restrictions on third-party applications. CVE-2022-26706: Arsenii Kostromin (0x3c3e) libxml2 Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2022-23308 Security Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A malicious app may be able to bypass signature validation Description: A certificate parsing issue was addressed with improved checks. CVE-2022-26766: Linus Henze of Pinauten GmbH (pinauten.de) WebKit Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: Processing maliciously crafted web content may lead to code execution Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 238178 CVE-2022-26700: ryuzaki WebKit Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. WebKit Bugzilla: 236950 CVE-2022-26709: Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab WebKit Bugzilla: 237475 CVE-2022-26710: Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab WebKit Bugzilla: 238171 CVE-2022-26717: Jeonghoon Shin of Theori WebKit Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 238183 CVE-2022-26716: SorryMybad (@S0rryMybad) of Kunlun Lab WebKit Bugzilla: 238699 CVE-2022-26719: Dongzhuo Zhao working with ADLab of Venustech Wi-Fi Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A malicious application may disclose restricted memory Description: A memory corruption issue was addressed with improved validation. CVE-2022-26745: an anonymous researcher Additional recognition AppleMobileFileIntegrity We would like to acknowledge Wojciech Reguła (@_r3ggi) of SecuRing for their assistance. WebKit We would like to acknowledge James Lee, an anonymous researcher for their assistance. Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmKC1TcACgkQeC9qKD1p rhiw7BAAy82XZ2+vjnjFB1FrZ7ZnKtM4pz8MMpX4ZTD2ytgkwXi0qnyzBdMe/w4p zrpedL4p/RfdDOiM/4kWBtiH62qetiXDcE8tBqN8WTE9rf55cX4jlXrHASohFI2q ErkAjo51j2fg8S7a+luyaZWzBUZqlghtzWjtFgaHOQAP5dDf+He92kDerbrIDQw9 dg0nL4os0VFgWdX0EtFC7umK8iiTFbvtoEbLDLFODWweaJN8LOP/LHe71YzAryKg Dh9ItWqVdzkCOKWR8F96NnoBs7c6B4naqQkS4k2F/m6C6ckPb8LI18ss7oiD3eMB k7oo7+u1zQFRKmk0XlfH7awxtEHjYjjw3LT8ko9QJ8mEuspxoiwW7n1mINWa7Khp YoCe88xR06kfti4h6MJDSN6JpxSnikEyJzR4j4xGL6rWjqCj+XV9ejrt9EgF8BL2 JZ+Oceoh23m7IqVoMe1Hzjf1X3nsxXJQEg/xxRwHRknAjSNtVJUKhT4/ioOc9pu6 TROAHYdSO5yRLNUNpj9RlkBeDbXtiWgA2IEg0wcUPzwf3Uzt2Qw9zBFbMb1hPSht 7zTIOtF4Ub+MD6cFuHbC7hL58pRmA4FzEczLG81BoGGaFOCD2QDt0/ySTFr1M+YD g2L2PlZNgxd0zetkTkZbvAwroMUTRSi1GqxAhVeKwbvW4XAN+yc= =G3ho -----END PGP SIGNATURE-----

Trust: 1.98

sources: NVD: CVE-2022-26763 // JVNDB: JVNDB-2022-011442 // VULHUB: VHN-417432 // VULMON: CVE-2022-26763 // PACKETSTORM: 167193 // PACKETSTORM: 167194

AFFECTED PRODUCTS

vendor:applemodel:macosscope:ltversion:12.4

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:15.5

Trust: 1.0

vendor:applemodel:macosscope:gteversion:12.0

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:15.5

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:8.6

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.6.6

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.15.7

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:15.5

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.15.7

Trust: 1.0

vendor:アップルmodel:apple mac os xscope: - version: -

Trust: 0.8

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

vendor:アップルmodel:watchosscope: - version: -

Trust: 0.8

vendor:アップルmodel:tvosscope: - version: -

Trust: 0.8

vendor:アップルmodel:ipadosscope: - version: -

Trust: 0.8

vendor:アップルmodel:macosscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-011442 // NVD: CVE-2022-26763

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-26763
value: HIGH

Trust: 1.0

NVD: CVE-2022-26763
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202205-3489
value: HIGH

Trust: 0.6

VULHUB: VHN-417432
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-26763
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-417432
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-26763
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-26763
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-417432 // JVNDB: JVNDB-2022-011442 // CNNVD: CNNVD-202205-3489 // NVD: CVE-2022-26763

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.1

problemtype:Buffer error (CWE-119) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-417432 // JVNDB: JVNDB-2022-011442 // NVD: CVE-2022-26763

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202205-3489

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202205-3489

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-417432

PATCH
title:HT213257 Apple  Security updateurl:https://support.apple.com/en-us/HT213253
Trust: 0.8
title:Apple TV Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=193018
Trust: 0.6
title:Apple: macOS Monterey 12.4url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=73857ee26a600b1527481f1deacc0619
Trust: 0.1
title:Apple: iOS 15.5 and iPadOS 15.5url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=f66f27c9aed3f1df2b9271d627617604
Trust: 0.1
title:Apple: watchOS 8.6url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=6bd411659b23f6a36cfd1c59cf69e092
Trust: 0.1
sources:
            
            
            VULMON: CVE-2022-26763 // 
            
            
            
            JVNDB: JVNDB-2022-011442 // 
            
            
            
            CNNVD: CNNVD-202205-3489

EXTERNAL IDS
db:NVDid:CVE-2022-26763
Trust: 3.6
db:PACKETSTORMid:167194
Trust: 0.8
db:JVNDBid:JVNDB-2022-011442
Trust: 0.8
db:PACKETSTORMid:168664
Trust: 0.7
db:CS-HELPid:SB2022051708
Trust: 0.6
db:AUSCERTid:ESB-2022.2411
Trust: 0.6
db:CNNVDid:CNNVD-202205-3489
Trust: 0.6
db:PACKETSTORMid:167193
Trust: 0.2
db:VULHUBid:VHN-417432
Trust: 0.1
db:VULMONid:CVE-2022-26763
Trust: 0.1
sources:
            
            
            VULHUB: VHN-417432 // 
            
            
            
            VULMON: CVE-2022-26763 // 
            
            
            
            JVNDB: JVNDB-2022-011442 // 
            
            
            
            PACKETSTORM: 167193 // 
            
            
            
            PACKETSTORM: 167194 // 
            
            
            
            CNNVD: CNNVD-202205-3489 // 
            
            
            
            NVD: CVE-2022-26763

REFERENCES
url:https://support.apple.com/en-us/ht213254
Trust: 2.3
url:https://support.apple.com/en-us/ht213253
Trust: 1.7
url:https://support.apple.com/en-us/ht213255
Trust: 1.7
url:https://support.apple.com/en-us/ht213256
Trust: 1.7
url:https://support.apple.com/en-us/ht213257
Trust: 1.7
url:https://support.apple.com/en-us/ht213258
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2022-26763
Trust: 1.0
url:https://vigilance.fr/vulnerability/apple-ios-multiple-vulnerabilities-38380
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022051708
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2022-26763/
Trust: 0.6
url:https://packetstormsecurity.com/files/168664/macos-12.3.1-local-root.html
Trust: 0.6
url:https://packetstormsecurity.com/files/167194/apple-security-advisory-2022-05-16-6.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.2411
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2022-23308
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26719
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26766
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26714
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26709
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26702
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26764
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26717
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26745
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26765
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26700
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26716
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26757
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-22675
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26706
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26710
Trust: 0.2
url:https://www.apple.com/support/security/pgp/
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26711
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-26768
Trust: 0.2
url:https://support.apple.com/en-us/ht201222.
Trust: 0.2
url:https://support.apple.com/kb/ht213257
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26771
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26726
Trust: 0.1
url:https://support.apple.com/kb/ht204641
Trust: 0.1
url:https://support.apple.com/ht213253.
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26701
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26738
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26740
Trust: 0.1
url:https://support.apple.com/ht213254.
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26736
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26737
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26724
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-26739
Trust: 0.1
sources:
            
            
            VULHUB: VHN-417432 // 
            
            
            
            VULMON: CVE-2022-26763 // 
            
            
            
            JVNDB: JVNDB-2022-011442 // 
            
            
            
            PACKETSTORM: 167193 // 
            
            
            
            PACKETSTORM: 167194 // 
            
            
            
            CNNVD: CNNVD-202205-3489 // 
            
            
            
            NVD: CVE-2022-26763

CREDITS
Apple
Trust: 0.2
sources:
            
            
            PACKETSTORM: 167193 // 
            
            
            
            PACKETSTORM: 167194

SOURCES
db:VULHUBid:VHN-417432
db:VULMONid:CVE-2022-26763
db:JVNDBid:JVNDB-2022-011442
db:PACKETSTORMid:167193
db:PACKETSTORMid:167194
db:CNNVDid:CNNVD-202205-3489
db:NVDid:CVE-2022-26763

LAST UPDATE DATE
2024-08-14T12:08:23.506000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-417432date:2022-06-08T00:00:00
db:JVNDBid:JVNDB-2022-011442date:2023-08-22T06:13:00
db:CNNVDid:CNNVD-202205-3489date:2022-10-11T00:00:00
db:NVDid:CVE-2022-26763date:2022-06-08T12:49:39.693

SOURCES RELEASE DATE
db:VULHUBid:VHN-417432date:2022-05-26T00:00:00
db:JVNDBid:JVNDB-2022-011442date:2023-08-22T00:00:00
db:PACKETSTORMid:167193date:2022-05-17T17:06:32
db:PACKETSTORMid:167194date:2022-05-17T17:06:48
db:CNNVDid:CNNVD-202205-3489date:2022-05-16T00:00:00
db:NVDid:CVE-2022-26763date:2022-05-26T20:15:09.527