Details of VAR-202207-1505

ID

VAR-202207-1505

CVE

CVE-2022-32839

TITLE

Vulnerabilities in multiple Apple products

Trust: 0.8

sources: JVNDB: JVNDB-2022-017327

DESCRIPTION

The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6, tvOS 15.6, watchOS 8.7. A remote user may cause an unexpected app termination or arbitrary code execution. iPadOS , iOS , Apple Mac OS X Unspecified vulnerabilities exist in multiple Apple products.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Both Apple iOS and Apple iPadOS are products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Apple iOS versions prior to 15.6 and iPadOS versions prior to 15.6 have a buffer error vulnerability that stems from a boundary error in CoreText that allows a remote attacker to create a specially crafted document that tricks the victim into opening it, causing memory corruption and execution on the target system arbitrary code

Trust: 1.71

sources: NVD: CVE-2022-32839 // JVNDB: JVNDB-2022-017327 // VULHUB: VHN-424928

AFFECTED PRODUCTS

vendor:	apple	model:	macos	scope:	lt	version:	10.15.7	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	lt	version:	15.6	Trust: 1.0
vendor:	apple	model:	macos	scope:	eq	version:	10.15.7	Trust: 1.0
vendor:	apple	model:	macos	scope:	gte	version:	12.0	Trust: 1.0
vendor:	apple	model:	watchos	scope:	lt	version:	8.7	Trust: 1.0
vendor:	apple	model:	ipados	scope:	lt	version:	15.6	Trust: 1.0
vendor:	apple	model:	macos	scope:	lt	version:	11.6.8	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	eq	version:	10.15.7	Trust: 1.0
vendor:	apple	model:	macos	scope:	gte	version:	11.0	Trust: 1.0
vendor:	apple	model:	tvos	scope:	lt	version:	15.6	Trust: 1.0
vendor:	apple	model:	macos	scope:	lt	version:	12.5	Trust: 1.0
vendor:	アップル	model:	tvos	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	ipados	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	apple mac os x	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	apple watch	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	ios	scope:	-	version:	-	Trust: 0.8
vendor:	アップル	model:	macos	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-017327 // NVD: CVE-2022-32839

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-32839
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2022-32839
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-202207-2087
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2022-32839
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2022-32839
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-017327 // CNNVD: CNNVD-202207-2087 // NVD: CVE-2022-32839

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-017327 // NVD: CVE-2022-32839

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-2087

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202207-2087

PATCH

title:	HT213345 Apple Security update	url:	https://support.apple.com/en-us/HT213340	Trust: 0.8
title:	Apple iOS and iPadOS Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=206030	Trust: 0.6
title:	Apple: macOS Big Sur 11.6.8	url:	https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=46307825e8223bef6aa99c76dff503a5	Trust: 0.1
title:	Apple: iOS 15.6 and iPadOS 15.6	url:	https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=25de7f37f4830a629a57f79175aeaa2a	Trust: 0.1
title:	Apple: macOS Monterey 12.5	url:	https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=c765c13fa342a7957a4e91e6dc3d34f4	Trust: 0.1
title:	Apple: Security Update 2022-005 Catalina	url:	https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=b71ee1a3b689c178ee5a5bc823295063	Trust: 0.1

sources: VULMON: CVE-2022-32839 // JVNDB: JVNDB-2022-017327 // CNNVD: CNNVD-202207-2087

EXTERNAL IDS

db:	NVD	id:	CVE-2022-32839	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-017327	Trust: 0.8
db:	CNNVD	id:	CNNVD-202207-2087	Trust: 0.7
db:	CS-HELP	id:	SB2022072107	Trust: 0.6
db:	AUSCERT	id:	ESB-2022.3563	Trust: 0.6
db:	VULHUB	id:	VHN-424928	Trust: 0.1
db:	VULMON	id:	CVE-2022-32839	Trust: 0.1

sources: VULHUB: VHN-424928 // VULMON: CVE-2022-32839 // JVNDB: JVNDB-2022-017327 // CNNVD: CNNVD-202207-2087 // NVD: CVE-2022-32839

REFERENCES

url:	https://support.apple.com/en-us/ht213346	Trust: 2.3
url:	https://support.apple.com/en-us/ht213340	Trust: 1.7
url:	https://support.apple.com/en-us/ht213342	Trust: 1.7
url:	https://support.apple.com/en-us/ht213343	Trust: 1.7
url:	https://support.apple.com/en-us/ht213344	Trust: 1.7
url:	https://support.apple.com/en-us/ht213345	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2022-32839	Trust: 1.4
url:	https://vigilance.fr/vulnerability/apple-macos-12-multiple-vulnerabilities-38873	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-32839/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2022.3563	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2022072107	Trust: 0.6
url:	https://support.apple.com/kb/ht213344	Trust: 0.1

sources: VULHUB: VHN-424928 // VULMON: CVE-2022-32839 // JVNDB: JVNDB-2022-017327 // CNNVD: CNNVD-202207-2087 // NVD: CVE-2022-32839

SOURCES

db:	VULHUB	id:	VHN-424928
db:	VULMON	id:	CVE-2022-32839
db:	JVNDB	id:	JVNDB-2022-017327
db:	CNNVD	id:	CNNVD-202207-2087
db:	NVD	id:	CVE-2022-32839

LAST UPDATE DATE

2024-08-14T12:58:23.313000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-424928	date:	2022-11-02T00:00:00
db:	JVNDB	id:	JVNDB-2022-017327	date:	2023-10-12T07:35:00
db:	CNNVD	id:	CNNVD-202207-2087	date:	2022-08-30T00:00:00
db:	NVD	id:	CVE-2022-32839	date:	2022-11-02T13:18:35.983

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-424928	date:	2022-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2022-017327	date:	2023-10-12T00:00:00
db:	CNNVD	id:	CNNVD-202207-2087	date:	2022-07-20T00:00:00
db:	NVD	id:	CVE-2022-32839	date:	2022-08-24T20:15:09.010