Sign-up

ID

VAR-202209-0770


CVE

CVE-2022-32912


TITLE

Out-of-bounds read vulnerability in multiple Apple products

Trust: 0.8

sources: JVNDB: JVNDB-2022-018923

DESCRIPTION

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution. apple's Safari , iPadOS , iOS Exists in an out-of-bounds read vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple WebKit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the implementation of the drawRangeElements method in WebGL2. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. There is a security vulnerability in Apple macOS Safari WebKit. A remote attacker can use this vulnerability to submit a special web request, trick the user into parsing it, cause the service program to crash or execute arbitrary code in the application context. Apple is aware of a report that this issue may have been actively exploited. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-09-12-1 iOS 16 iOS 16 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213446. Additional CVE entries to be added soon. Contacts Available for: iPhone 8 and later Impact: An app may be able to bypass Privacy preferences Description: This issue was addressed with improved checks. CVE-2022-32854: Holger Fuhrmannek of Deutsche Telekom Security Kernel Available for: iPhone 8 and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-32911: Zweig of Kunlun Lab Kernel Available for: iPhone 8 and later Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2022-32864: Linus Henze of Pinauten GmbH (pinauten.de) Kernel Available for: iPhone 8 and later Impact: An application may be able to execute arbitrary code with kernel privileges. CVE-2022-32917: an anonymous researcher Maps Available for: iPhone 8 and later Impact: An app may be able to read sensitive location information Description: A logic issue was addressed with improved restrictions. CVE-2022-32883: Ron Masas, breakpointhq.com MediaLibrary Available for: iPhone 8 and later Impact: A user may be able to elevate privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2022-32908: an anonymous researcher Safari Available for: iPhone 8 and later Impact: Visiting a malicious website may lead to address bar spoofing Description: This issue was addressed with improved checks. CVE-2022-32795: Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) @imnarendrabhati Safari Extensions Available for: iPhone 8 and later Impact: A website may be able to track users through Safari web extensions Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 242278 CVE-2022-32868: Michael Shortcuts Available for: iPhone 8 and later Impact: A person with physical access to an iOS device may be able to access photos from the lock screen Description: A logic issue was addressed with improved restrictions. WebKit Bugzilla: 242762 CVE-2022-32912: Jeonghoon Shin (@singi21a) at Theori working with Trend Micro Zero Day Initiative Additional recognition Game Center We would like to acknowledge Joshua Jones for their assistance. Identity Services We would like to acknowledge Joshua Jones for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 16". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmMfdgEACgkQ4RjMIDke NxlhOhAApZYokZaK7dpu3iZkFM0Ko2bn4lmXIKFXx+gYrHKhUlNg1VkKaDzl+Rts 3atFGho+AwARh4Abbc7/t1cdtflcr37cFcTszZ4ONllJ2rxNkRzvZa3H5fPgOL8T j1UqNI8zvQA1OmAj2mxWo+SUbGPVYCesuX6INl0xfd6PTcTf1xKDTgo292FVAJ7c zCjVevodGNJognUy81DVhInJ1m4bMFt/3RC57o586OHyohiemdXrCAKML76qc8Eq 9gdTmB4P3NkxWTMWCbIIjX3x1FUEWkJ6liHEIMOwv/hwNGLJtI5R5QUYvbtz+a30 3L+AfZbmOs2yGVx0YQY16UtoRAEs3ig310G3MDL4ZlcHYQDWqNS2UvY2Hs0nzvkV fpFNPsuF6iDWYOjzhe9GXCzekgH8Ojva0EqQCydd1dD0frJivjWpWCYQucS52PH1 DSnjk0bLowECavj+R6C1IoCX9dKW0/Ybyugmelyn7Q1tKK0xxXUqAMgAaH1DbLVu Ca/ZN/s3lJYzFoV6DXX9wUQB0QsaQCiC/kKvvjyUVuNVxzekmTsKpI+dxzl0zAs7 0S3SqcBYnHDwjUZvqGzbFzIv9nPjDUlfsnRtBVzS67lJAj6gjNv9O1Siw+PlLP1/ nb/OZkXaQNRV0nyB9u/Mp92/V2UAvdSFTMtfrl+26WVw7Up3pAY= =QZox -----END PGP SIGNATURE----- . WebKit Bugzilla: 243181 CVE-2022-32892: @18楼梦想改造家 and @jq0904 of DBAppSecurity's WeBin lab Entry added October 27, 2022 Safari 16 may be obtained from the Mac App Store. CVE-2022-1622 Image Processing Available for: Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD Impact: A sandboxed app may be able to determine which app is currently using the camera Description: The issue was addressed with additional restrictions on the observability of app states

Trust: 2.79

sources: NVD: CVE-2022-32912 // JVNDB: JVNDB-2022-018923 // ZDI: ZDI-23-646 // VULHUB: VHN-425001 // PACKETSTORM: 168342 // PACKETSTORM: 168362 // PACKETSTORM: 168341 // PACKETSTORM: 169602 // PACKETSTORM: 169589

AFFECTED PRODUCTS

vendor:applemodel:ipadosscope:ltversion:15.7

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:15.7

Trust: 1.0

vendor:applemodel:safariscope:ltversion:16.0

Trust: 1.0

vendor:アップルmodel:safariscope: - version: -

Trust: 0.8

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

vendor:アップルmodel:ipadosscope:eqversion:15.7

Trust: 0.8

vendor:applemodel:webkitscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-23-646 // JVNDB: JVNDB-2022-018923 // NVD: CVE-2022-32912

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-32912
value: HIGH

Trust: 1.0

NVD: CVE-2022-32912
value: HIGH

Trust: 0.8

ZDI: CVE-2022-32912
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-202209-768
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2022-32912
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-32912
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-32912
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-646 // JVNDB: JVNDB-2022-018923 // CNNVD: CNNVD-202209-768 // NVD: CVE-2022-32912

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.1

problemtype:Out-of-bounds read (CWE-125) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-425001 // JVNDB: JVNDB-2022-018923 // NVD: CVE-2022-32912

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202209-768

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202209-768

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-425001

PATCH
title:HT213445 Apple  Security updateurl:https://support.apple.com/en-us/HT213442
Trust: 0.8
title:Apple has issued an update to correct this vulnerability.url:https://support.apple.com/HT213442
Trust: 0.7
title:Apple macOS Safari Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=208771
Trust: 0.6
sources:
            
            
            ZDI: ZDI-23-646 // 
            
            
            
            JVNDB: JVNDB-2022-018923 // 
            
            
            
            CNNVD: CNNVD-202209-768

EXTERNAL IDS
db:NVDid:CVE-2022-32912
Trust: 4.5
db:PACKETSTORMid:168362
Trust: 0.8
db:PACKETSTORMid:169602
Trust: 0.8
db:JVNDBid:JVNDB-2022-018923
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-17329
Trust: 0.7
db:ZDIid:ZDI-23-646
Trust: 0.7
db:AUSCERTid:ESB-2022.5473
Trust: 0.6
db:AUSCERTid:ESB-2022.5005
Trust: 0.6
db:AUSCERTid:ESB-2022.4527
Trust: 0.6
db:AUSCERTid:ESB-2022.5300
Trust: 0.6
db:AUSCERTid:ESB-2022.5462
Trust: 0.6
db:CNNVDid:CNNVD-202209-768
Trust: 0.6
db:PACKETSTORMid:169589
Trust: 0.2
db:PACKETSTORMid:168341
Trust: 0.2
db:PACKETSTORMid:168342
Trust: 0.2
db:CNVDid:CNVD-2022-71988
Trust: 0.1
db:VULHUBid:VHN-425001
Trust: 0.1
sources:
            
            
            ZDI: ZDI-23-646 // 
            
            
            
            VULHUB: VHN-425001 // 
            
            
            
            JVNDB: JVNDB-2022-018923 // 
            
            
            
            PACKETSTORM: 168342 // 
            
            
            
            PACKETSTORM: 168362 // 
            
            
            
            PACKETSTORM: 168341 // 
            
            
            
            PACKETSTORM: 169602 // 
            
            
            
            PACKETSTORM: 169589 // 
            
            
            
            CNNVD: CNNVD-202209-768 // 
            
            
            
            NVD: CVE-2022-32912

REFERENCES
url:http://seclists.org/fulldisclosure/2022/oct/28
Trust: 2.5
url:http://seclists.org/fulldisclosure/2022/oct/47
Trust: 2.5
url:http://seclists.org/fulldisclosure/2022/oct/49
Trust: 2.5
url:http://seclists.org/fulldisclosure/2022/oct/50
Trust: 2.5
url:http://seclists.org/fulldisclosure/2022/oct/39
Trust: 2.5
url:http://seclists.org/fulldisclosure/2022/oct/40
Trust: 2.5
url:http://seclists.org/fulldisclosure/2022/oct/41
Trust: 2.5
url:https://support.apple.com/en-us/ht213442
Trust: 2.3
url:https://support.apple.com/en-us/ht213445
Trust: 1.7
url:https://support.apple.com/en-us/ht213446
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2022-32912
Trust: 1.3
url:https://support.apple.com/ht213442
Trust: 0.7
url:https://www.auscert.org.au/bulletins/esb-2022.4527
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2022-32912/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.5462
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.5473
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.5300
Trust: 0.6
url:https://vigilance.fr/vulnerability/apple-ios-macos-multiple-vulnerabilities-39249
Trust: 0.6
url:https://vigilance.fr/vulnerability/webkitgtk-wpe-webkit-three-vulnerabilities-39368
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.5005
Trust: 0.6
url:https://support.apple.com/en-us/ht213488
Trust: 0.6
url:https://packetstormsecurity.com/files/168362/apple-security-advisory-2022-09-12-5.html
Trust: 0.6
url:https://packetstormsecurity.com/files/169602/apple-security-advisory-2022-10-27-14.html
Trust: 0.6
url:https://www.apple.com/support/security/pgp/
Trust: 0.5
url:https://nvd.nist.gov/vuln/detail/cve-2022-32886
Trust: 0.5
url:https://support.apple.com/en-us/ht201222.
Trust: 0.5
url:https://nvd.nist.gov/vuln/detail/cve-2022-32868
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2022-32864
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2022-32908
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2022-32911
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2022-32891
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2022-32917
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-32795
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-32854
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-32872
Trust: 0.2
url:https://www.apple.com/itunes/
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-32883
Trust: 0.2
url:https://support.apple.com/ht213442.
Trust: 0.2
url:https://support.apple.com/ht213445.
Trust: 0.1
url:https://support.apple.com/ht213446.
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32892
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32866
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32907
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32888
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-36690
Trust: 0.1
url:https://support.apple.com/ht213487.
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-1622
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32879
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32903
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32881
Trust: 0.1
sources:
            
            
            ZDI: ZDI-23-646 // 
            
            
            
            VULHUB: VHN-425001 // 
            
            
            
            JVNDB: JVNDB-2022-018923 // 
            
            
            
            PACKETSTORM: 168342 // 
            
            
            
            PACKETSTORM: 168362 // 
            
            
            
            PACKETSTORM: 168341 // 
            
            
            
            PACKETSTORM: 169602 // 
            
            
            
            PACKETSTORM: 169589 // 
            
            
            
            CNNVD: CNNVD-202209-768 // 
            
            
            
            NVD: CVE-2022-32912

CREDITS
Anonymous
Trust: 0.7
sources:
            
            
            ZDI: ZDI-23-646

SOURCES
db:ZDIid:ZDI-23-646
db:VULHUBid:VHN-425001
db:JVNDBid:JVNDB-2022-018923
db:PACKETSTORMid:168342
db:PACKETSTORMid:168362
db:PACKETSTORMid:168341
db:PACKETSTORMid:169602
db:PACKETSTORMid:169589
db:CNNVDid:CNNVD-202209-768
db:NVDid:CVE-2022-32912

LAST UPDATE DATE
2024-08-14T12:05:17.548000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-23-646date:2024-07-08T00:00:00
db:VULHUBid:VHN-425001date:2022-12-07T00:00:00
db:JVNDBid:JVNDB-2022-018923date:2023-10-24T01:13:00
db:CNNVDid:CNNVD-202209-768date:2022-11-02T00:00:00
db:NVDid:CVE-2022-32912date:2022-12-07T03:11:02.450

SOURCES RELEASE DATE
db:ZDIid:ZDI-23-646date:2023-05-17T00:00:00
db:VULHUBid:VHN-425001date:2022-09-20T00:00:00
db:JVNDBid:JVNDB-2022-018923date:2023-10-24T00:00:00
db:PACKETSTORMid:168342date:2022-09-13T15:27:13
db:PACKETSTORMid:168362date:2022-09-13T15:45:03
db:PACKETSTORMid:168341date:2022-09-13T15:26:55
db:PACKETSTORMid:169602date:2022-10-31T15:01:45
db:PACKETSTORMid:169589date:2022-10-31T14:51:24
db:CNNVDid:CNNVD-202209-768date:2022-09-12T00:00:00
db:NVDid:CVE-2022-32912date:2022-09-20T21:15:11.160