Details of VAR-202205-2046

ID

VAR-202205-2046

CVE

CVE-2022-22672

TITLE

plural Apple Out-of-bounds write vulnerabilities in the product

Trust: 0.8

sources: JVNDB: JVNDB-2022-011807

DESCRIPTION

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious application may be able to execute arbitrary code with kernel privileges. iOS , iPadOS , tvOS macOS Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Apple iOS version 15.4 and iPadOS version 15.4 have a security flaw that stems from memory corruption

Trust: 1.8

sources: NVD: CVE-2022-22672 // JVNDB: JVNDB-2022-011807 // VULHUB: VHN-411300 // VULMON: CVE-2022-22672

AFFECTED PRODUCTS

vendor:	apple	model:	mac os x	scope:	eq	version:	10.15.7	Trust: 1.0
vendor:	apple	model:	ipados	scope:	lt	version:	15.4	Trust: 1.0
vendor:	apple	model:	macos	scope:	lt	version:	11.6.5	Trust: 1.0
vendor:	apple	model:	macos	scope:	gte	version:	12.0.0	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lt	version:	10.15.7	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	lt	version:	15.4	Trust: 1.0
vendor:	apple	model:	macos	scope:	gte	version:	11.0	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	gte	version:	10.15	Trust: 1.0
vendor:	apple	model:	macos	scope:	lt	version:	12.3	Trust: 1.0
vendor:	アップル	model:	ipados	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	ios	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	macos	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	apple mac os x	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-011807 // NVD: CVE-2022-22672

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-22672
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-22672
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202205-4223
value:	HIGH
Trust: 0.6
VULHUB:	VHN-411300
value:	HIGH
Trust: 0.1
VULMON:	CVE-2022-22672
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2022-22672
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-411300
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2022-22672
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2022-22672
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-411300 // VULMON: CVE-2022-22672 // JVNDB: JVNDB-2022-011807 // CNNVD: CNNVD-202205-4223 // NVD: CVE-2022-22672

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.1
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-411300 // JVNDB: JVNDB-2022-011807 // NVD: CVE-2022-22672

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202205-4223

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202205-4223

PATCH

title:	HT213184 Apple Security update	url:	https://support.apple.com/en-us/HT213182	Trust: 0.8
title:	Apple iOS and Apple iPadOS Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=195369	Trust: 0.6
title:	n-days	url:	https://github.com/b1n4r1b01/n-days	Trust: 0.1
title:	CVE-2022-XXXX	url:	https://github.com/AlphabugX/CVE-2022-23305	Trust: 0.1
title:	CVE-2022-XXXX	url:	https://github.com/AlphabugX/CVE-2022-RCE	Trust: 0.1

sources: VULMON: CVE-2022-22672 // JVNDB: JVNDB-2022-011807 // CNNVD: CNNVD-202205-4223

EXTERNAL IDS

db:	NVD	id:	CVE-2022-22672	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-011807	Trust: 0.8
db:	CNNVD	id:	CNNVD-202205-4223	Trust: 0.7
db:	VULHUB	id:	VHN-411300	Trust: 0.1
db:	VULMON	id:	CVE-2022-22672	Trust: 0.1

sources: VULHUB: VHN-411300 // VULMON: CVE-2022-22672 // JVNDB: JVNDB-2022-011807 // CNNVD: CNNVD-202205-4223 // NVD: CVE-2022-22672

REFERENCES

url:	https://support.apple.com/en-us/ht213182	Trust: 1.8
url:	https://support.apple.com/en-us/ht213183	Trust: 1.8
url:	https://support.apple.com/en-us/ht213184	Trust: 1.8
url:	https://support.apple.com/en-us/ht213185	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-22672	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-22672/	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/787.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/b1n4r1b01/n-days	Trust: 0.1
url:	https://github.com/alphabugx/cve-2022-23305	Trust: 0.1

sources: VULHUB: VHN-411300 // VULMON: CVE-2022-22672 // JVNDB: JVNDB-2022-011807 // CNNVD: CNNVD-202205-4223 // NVD: CVE-2022-22672

SOURCES

db:	VULHUB	id:	VHN-411300
db:	VULMON	id:	CVE-2022-22672
db:	JVNDB	id:	JVNDB-2022-011807
db:	CNNVD	id:	CNNVD-202205-4223
db:	NVD	id:	CVE-2022-22672

LAST UPDATE DATE

2024-11-23T22:32:47.606000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-411300	date:	2022-06-08T00:00:00
db:	VULMON	id:	CVE-2022-22672	date:	2022-06-08T00:00:00
db:	JVNDB	id:	JVNDB-2022-011807	date:	2023-08-24T02:22:00
db:	CNNVD	id:	CNNVD-202205-4223	date:	2022-06-09T00:00:00
db:	NVD	id:	CVE-2022-22672	date:	2024-11-21T06:47:14.713

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-411300	date:	2022-05-26T00:00:00
db:	VULMON	id:	CVE-2022-22672	date:	2022-05-26T00:00:00
db:	JVNDB	id:	JVNDB-2022-011807	date:	2023-08-24T00:00:00
db:	CNNVD	id:	CNNVD-202205-4223	date:	2022-05-26T00:00:00
db:	NVD	id:	CVE-2022-22672	date:	2022-05-26T18:15:09.007