Sign-up

ID

VAR-202210-2060


CVE

CVE-2022-32877


TITLE

apple's  macOS  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-022788

DESCRIPTION

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Monterey 12.6. An app may be able to access user-sensitive data. apple's macOS Exists in unspecified vulnerabilities.Information may be obtained. Information about the security content is also available at https://support.apple.com/HT213443. AppleMobileFileIntegrity Available for: macOS Big Sur Impact: An app may be able to access user-sensitive data Description: An issue in code signature validation was addressed with improved checks. CVE-2022-42789: Koh M. Nakagawa of FFRI Security, Inc. Entry added October 27, 2022 ATS Available for: macOS Big Sur Impact: An app may be able to access user-sensitive data Description: An access issue was addressed with additional sandbox restrictions. CVE-2022-32904: Mickey Jin (@patch1t) Entry added October 27, 2022 ATS Available for: macOS Big Sur Impact: An app may be able to bypass Privacy preferences Description: A logic issue was addressed with improved state management. CVE-2022-32902: Mickey Jin (@patch1t) Calendar Available for: macOS Big Sur Impact: An app may be able to read sensitive location information Description: An access issue was addressed with improved access restrictions. CVE-2022-42819: an anonymous researcher Entry added October 27, 2022 Contacts Available for: macOS Big Sur Impact: An app may be able to bypass Privacy preferences Description: This issue was addressed with improved checks. CVE-2022-32854: Holger Fuhrmannek of Deutsche Telekom Security GarageBand Available for: macOS Big Sur Impact: An app may be able to access user-sensitive data Description: A configuration issue was addressed with additional restrictions. CVE-2022-32877: Wojciech Reguła (@_r3ggi) of SecuRing Entry added October 27, 2022 ImageIO Available for: macOS Big Sur Impact: Processing an image may lead to a denial-of-service Description: A denial-of-service issue was addressed with improved validation. CVE-2022-1622 Entry added October 27, 2022 Image Processing Available for: macOS Big Sur Impact: A sandboxed app may be able to determine which app is currently using the camera Description: The issue was addressed with additional restrictions on the observability of app states. CVE-2022-32913: Yiğit Can YILMAZ (@yilmazcanyigit) Entry added October 27, 2022 iMovie Available for: macOS Big Sur Impact: A user may be able to view sensitive user information Description: This issue was addressed by enabling hardened runtime. CVE-2022-32896: Wojciech Reguła (@_r3ggi) Kernel Available for: macOS Big Sur Impact: An app may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed with improved memory management. CVE-2022-32914: Zweig of Kunlun Lab Entry added October 27, 2022 Kernel Available for: macOS Big Sur Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-32866: Linus Henze of Pinauten GmbH (pinauten.de) CVE-2022-32911: Zweig of Kunlun Lab CVE-2022-32924: Ian Beer of Google Project Zero Entry updated October 27, 2022 Kernel Available for: macOS Big Sur Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2022-32864: Linus Henze of Pinauten GmbH (pinauten.de) Kernel Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-32894: an anonymous researcher Kernel Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited. CVE-2022-32917: an anonymous researcher Maps Available for: macOS Big Sur Impact: An app may be able to read sensitive location information Description: A logic issue was addressed with improved restrictions. CVE-2022-32883: Ron Masas of breakpointhq.com Entry updated October 27, 2022 MediaLibrary Available for: macOS Big Sur Impact: A user may be able to elevate privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2022-32908: an anonymous researcher ncurses Available for: macOS Big Sur Impact: A user may be able to cause unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2021-39537 Entry added October 27, 2022 PackageKit Available for: macOS Big Sur Impact: An app may be able to gain elevated privileges Description: A logic issue was addressed with improved state management. CVE-2022-32900: Mickey Jin (@patch1t) Sandbox Available for: macOS Big Sur Impact: An app may be able to modify protected parts of the file system Description: A logic issue was addressed with improved restrictions. CVE-2022-32881: Csaba Fitzl (@theevilbit) of Offensive Security Entry added October 27, 2022 Security Available for: macOS Big Sur Impact: An app may be able to bypass code signing checks Description: An issue in code signature validation was addressed with improved checks. CVE-2022-42793: Linus Henze of Pinauten GmbH (pinauten.de) Entry added October 27, 2022 Sidecar Available for: macOS Big Sur Impact: A user may be able to view restricted content from the lock screen Description: A logic issue was addressed with improved state management. CVE-2022-42790: Om kothawade of Zaprico Digital Entry added October 27, 2022 SMB Available for: macOS Big Sur Impact: A remote user may be able to cause kernel code execution Description: The issue was addressed with improved memory handling. CVE-2022-32934: Felix Poulin-Belanger Entry added October 27, 2022 Vim Available for: macOS Big Sur Impact: Processing a maliciously crafted file may lead to a denial- of-service or potentially disclose memory contents Description: This issue was addressed with improved checks. CVE-2022-1720 CVE-2022-2000 CVE-2022-2042 CVE-2022-2124 CVE-2022-2125 CVE-2022-2126 Entry added October 27, 2022 Weather Available for: macOS Big Sur Impact: An app may be able to read sensitive location information Description: A logic issue was addressed with improved state management. CVE-2022-32875: an anonymous researcher Entry added October 27, 2022 WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. WebKit Bugzilla: 242047 CVE-2022-32888: P1umer (@p1umer) Entry added October 27, 2022 Additional recognition Identity Services We would like to acknowledge Joshua Jones for their assistance. macOS Big Sur 11.7 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmNbKpYACgkQ4RjMIDke NxnDzw/7BbMWXxZ6uPMWb3LMFZlymEZMCtL5S27GA8HXiz7SU6c2wPrF1ofp8Bbz pYGy4OrK17rAb/qHIig03TVE6EJl4ScZHv7STn1gQ5ciKqud6jL16mm2BjRCm2T4 ZQtTzrQrSRHJbBSUSsnZxi5Wp9wjIA6w8JVvMqdBrnpu3yWt8Jo0tW0d/nO1EK3I QlfDgOaiZrdHN2m/Y+kjWOhRqDLe2QWObQh95Gyybi3++ctTr58PBLBYLhWgLMoV AMj69PLudFI8cEeqhDlfVK7ept2O+WLkYeI/Px5nG7YHhndr9fiR55Rz5m2Hl44k rnxDKs9hVQLwSHAo9uJ1DBUteEzgdUJWiwGxP4InnCmhlXpJl7AkVsr7bq5iaDcT o32wNfv1BEzBBvINNfw1PZ+JwNmEwugSj1UX54GFOj3B9WjGguIi0dMqOc0j6GKm xnIwzPIlHhHb/1D17kl/kTQH602w/Mf5OIlSfL/mk0CKjwR+0QvQF5HXhULJHbqJ Kpx8C1JfhnyWqBoCuh+URCKlZJ4T3P6IUgoRzuX4Jk3TDABCP5jgEZOzj76JPE1y IVt8ULLARjjUdEOzC8dZkaeGUOAerzfxIU8QJwmrnHQI3vQX7JR9MbK1S+PRJsGy 1h69HcdL2HGpjPyDf9uI2nMOntOUrTz/PqjQUzmfllq3B42RPZs= =euaC -----END PGP SIGNATURE-----

Trust: 1.8

sources: NVD: CVE-2022-32877 // JVNDB: JVNDB-2022-022788 // VULHUB: VHN-424966 // PACKETSTORM: 169585

AFFECTED PRODUCTS

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:macosscope:ltversion:12.6

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.7

Trust: 1.0

vendor:applemodel:macosscope:gteversion:12.0

Trust: 1.0

vendor:アップルmodel:macosscope:eqversion:12.0 that's all 12.6

Trust: 0.8

vendor:アップルmodel:macosscope:eqversion:11.0 that's all 11.7

Trust: 0.8

vendor:アップルmodel:macosscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-022788 // NVD: CVE-2022-32877

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-32877
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-32877
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202210-2515
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-32877
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2022-32877
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-022788 // CNNVD: CNNVD-202210-2515 // NVD: CVE-2022-32877

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-022788 // NVD: CVE-2022-32877

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202210-2515

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202210-2515

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-424966

PATCH
title:HT213444 Apple  Security updateurl:https://support.apple.com/en-us/HT213443
Trust: 0.8
title:Apple macOS Monterey Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=212725
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2022-022788 // 
            
            
            
            CNNVD: CNNVD-202210-2515

EXTERNAL IDS
db:NVDid:CVE-2022-32877
Trust: 3.4
db:PACKETSTORMid:169585
Trust: 0.8
db:JVNDBid:JVNDB-2022-022788
Trust: 0.8
db:CNNVDid:CNNVD-202210-2515
Trust: 0.6
db:VULHUBid:VHN-424966
Trust: 0.1
sources:
            
            
            VULHUB: VHN-424966 // 
            
            
            
            JVNDB: JVNDB-2022-022788 // 
            
            
            
            PACKETSTORM: 169585 // 
            
            
            
            CNNVD: CNNVD-202210-2515 // 
            
            
            
            NVD: CVE-2022-32877

REFERENCES
url:https://support.apple.com/en-us/ht213443
Trust: 1.7
url:https://support.apple.com/en-us/ht213444
Trust: 1.7
url:https://support.apple.com/kb/ht213446
Trust: 1.0
url:https://nvd.nist.gov/vuln/detail/cve-2022-32877
Trust: 0.9
url:https://packetstormsecurity.com/files/169585/apple-security-advisory-2022-10-27-9.html
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2022-32877/
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2022-32866
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32875
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-1720
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-2125
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32864
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-2042
Trust: 0.1
url:https://support.apple.com/en-us/ht201222.
Trust: 0.1
url:https://support.apple.com/downloads/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-1622
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-2124
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-39537
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-2000
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32854
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-2126
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-32881
Trust: 0.1
url:https://support.apple.com/ht213443.
Trust: 0.1
sources:
            
            
            VULHUB: VHN-424966 // 
            
            
            
            JVNDB: JVNDB-2022-022788 // 
            
            
            
            PACKETSTORM: 169585 // 
            
            
            
            CNNVD: CNNVD-202210-2515 // 
            
            
            
            NVD: CVE-2022-32877

CREDITS
Apple
Trust: 0.1
sources:
            
            
            PACKETSTORM: 169585

SOURCES
db:VULHUBid:VHN-424966
db:JVNDBid:JVNDB-2022-022788
db:PACKETSTORMid:169585
db:CNNVDid:CNNVD-202210-2515
db:NVDid:CVE-2022-32877

LAST UPDATE DATE
2024-08-14T12:45:25.421000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-424966date:2022-11-03T00:00:00
db:JVNDBid:JVNDB-2022-022788date:2023-11-21T00:48:00
db:CNNVDid:CNNVD-202210-2515date:2022-11-04T00:00:00
db:NVDid:CVE-2022-32877date:2023-03-17T02:15:47.443

SOURCES RELEASE DATE
db:VULHUBid:VHN-424966date:2022-11-01T00:00:00
db:JVNDBid:JVNDB-2022-022788date:2023-11-21T00:00:00
db:PACKETSTORMid:169585date:2022-10-31T14:50:18
db:CNNVDid:CNNVD-202210-2515date:2022-10-31T00:00:00
db:NVDid:CVE-2022-32877date:2022-11-01T20:15:18.373