ID

VAR-202301-1713


CVE

CVE-2023-23505


TITLE

Vulnerability related to information leakage from log files in multiple Apple products

Trust: 0.8

sources: JVNDB: JVNDB-2023-004743

DESCRIPTION

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, iOS 15.7.3 and iPadOS 15.7.3, iOS 16.3 and iPadOS 16.3. An app may be able to access information about a user’s contacts. iPadOS , iOS , macOS A number of Apple products, including the following, contain vulnerabilities related to information leakage from log files.Information may be obtained. Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2023-01-23-1 iOS 16.3 and iPadOS 16.3 iOS 16.3 and iPadOS 16.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213606. AppleMobileFileIntegrity Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access user-sensitive data Description: This issue was addressed by enabling hardened runtime. CVE-2023-23499: Wojciech Reguła (@_r3ggi) of SecuRing (wojciechregula.blog) ImageIO Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to a denial-of-service Description: A memory corruption issue was addressed with improved state management. CVE-2023-23519: Yiğit Can YILMAZ (@yilmazcanyigit) Kernel Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: An app may be able to leak sensitive kernel state Description: The issue was addressed with improved memory handling. CVE-2023-23500: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. (@starlabs_sg) Kernel Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: An app may be able to determine kernel memory layout Description: An information disclosure issue was addressed by removing the vulnerable code. CVE-2023-23502: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. (@starlabs_sg) Kernel Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2023-23504: Adam Doupé of ASU SEFCOM Mail Drafts Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: The quoted original message may be selected from the wrong email when forwarding an email from an Exchange account Description: A logic issue was addressed with improved state management. CVE-2023-23498: an anonymous researcher Maps Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: An app may be able to bypass Privacy preferences Description: A logic issue was addressed with improved state management. CVE-2023-23503: an anonymous researcher Safari Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: Visiting a website may lead to an app denial-of-service Description: The issue was addressed with improved handling of caches. CVE-2023-23512: Adriatik Raci Screen Time Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access information about a user’s contacts Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-23505: Wojciech Reguła of SecuRing (wojciechregula.blog) Weather Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: An app may be able to bypass Privacy preferences Description: The issue was addressed with improved memory handling. CVE-2023-23511: Wojciech Regula of SecuRing (wojciechregula.blog), an anonymous researcher WebKit Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: The issue was addressed with improved checks. WebKit Bugzilla: 245464 CVE-2023-23496: ChengGang Wu, Yan Kang, YuHao Hu, Yue Sun, Jiming Wang, JiKai Ren and Hang Shu of Institute of Computing Technology, Chinese Academy of Sciences WebKit Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 248268 CVE-2023-23518: YeongHyeon Choi (@hyeon101010), Hyeon Park (@tree_segment), SeOk JEON (@_seokjeon), YoungSung Ahn (@_ZeroSung), JunSeo Bae (@snakebjs0107), Dohyun Lee (@l33d0hyun) of Team ApplePIE WebKit Bugzilla: 248268 CVE-2023-23517: YeongHyeon Choi (@hyeon101010), Hyeon Park (@tree_segment), SeOk JEON (@_seokjeon), YoungSung Ahn (@_ZeroSung), JunSeo Bae (@snakebjs0107), Dohyun Lee (@l33d0hyun) of Team ApplePIE Additional recognition Kernel We would like to acknowledge Nick Stenning of Replicate for their assistance. Shortcuts We would like to acknowledge Baibhav Anand Jha from ReconWithMe and Cristian Dinca of Tudor Vianu National High School of Computer Science, Romania for their assistance. WebKit We would like to acknowledge Eliya Stein of Confiant for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 16.3 and iPadOS 16.3". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmPPIl4ACgkQ4RjMIDke NxniSRAAoaTuBBV5jk91bJapaGf/pqZV+h9vAV9B7sHzBRaJRq5fnoEm+Kdg6fS4 XZtTWhB9NXekrujHVMZC/AvboChvc94r1/qoF6vhVu1YYaDJkryFMlX4lbk5Jz7h k3gXHCpdARbburX46g0Fi9M6bL6dzG/6f4LG9L27dno5G/lcjHY9ylSnHHwuFcva 7kH2os9FmD3JMiopLwNKymfN1Z5AgC9TrDfztOcUChULBSxtx3eOP1+HWbpuQ6go vnEzAnnpoBl09f7EMfgGu4FpZiThsfFUCXNkdl23E+i8PrdRWW17Nqoqrnvb74pF jWOaelBBCdNee7TpfgfkGKT/PVADdoLdYmB5tqowvNWBfJ7ymB0Cir9BX74Iu0ld OcV49WJO4tr5swBF/Tgqx/k8dl8gj56g4tq+O+5TZZS42ep0l5JKgbpQtcGtujMZ CagKnA1+TM53yaSX6CJG/B09PnIUIow3jsx+FQlCUPo1Nl/kDWKLcZ7C9dIHjgaV Z9SZ5g0nalb5J4BY6wjuq/46FTewOH0bpGj5j992cNYM4aYUBDWvziXnlawuFzrw /tzA8xO2DUTpNPDdxixVfAIn9cp/VXK1mrj5BEGYXphvog+5E4vGDx9Ejth9qOSl zf1GlpaiipDI/bUjUz+A664r7/y88ulO8xB0xaANzr3xjwWI5JA= =sqSC -----END PGP SIGNATURE-----

Trust: 2.25

sources: NVD: CVE-2023-23505 // JVNDB: JVNDB-2023-004743 // VULHUB: VHN-451816 // VULMON: CVE-2023-23505 // PACKETSTORM: 170697 // PACKETSTORM: 170698 // PACKETSTORM: 170699 // PACKETSTORM: 170693 // PACKETSTORM: 170694

AFFECTED PRODUCTS

vendor:applemodel:watchosscope:ltversion:9.3

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:16.3

Trust: 1.0

vendor:applemodel:macosscope:gteversion:13.0

Trust: 1.0

vendor:applemodel:macosscope:ltversion:12.6.3

Trust: 1.0

vendor:applemodel:ipadosscope:gteversion:16.0

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.7.3

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:16.3

Trust: 1.0

vendor:applemodel:macosscope:gteversion:12.0.0

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:15.7.3

Trust: 1.0

vendor:applemodel:macosscope:ltversion:13.2

Trust: 1.0

vendor:applemodel:iphone osscope:gteversion:16.0

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:15.7.3

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:アップルmodel:macosscope: - version: -

Trust: 0.8

vendor:アップルmodel:watchosscope:eqversion:9.3

Trust: 0.8

vendor:アップルmodel:ipadosscope: - version: -

Trust: 0.8

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-004743 // NVD: CVE-2023-23505

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-23505
value: LOW

Trust: 1.0

NVD: CVE-2023-23505
value: LOW

Trust: 0.8

CNNVD: CNNVD-202301-1769
value: LOW

Trust: 0.6

nvd@nist.gov: CVE-2023-23505
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2023-23505
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-004743 // CNNVD: CNNVD-202301-1769 // NVD: CVE-2023-23505

PROBLEMTYPE DATA

problemtype:CWE-532

Trust: 1.1

problemtype:Information leakage from log files (CWE-532) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-451816 // JVNDB: JVNDB-2023-004743 // NVD: CVE-2023-23505

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202301-1769

TYPE

log information leak

Trust: 0.6

sources: CNNVD: CNNVD-202301-1769

PATCH

title:HT213605 Apple  Security updateurl:https://support.apple.com/en-us/HT213598

Trust: 0.8

title:Apple watchOS Repair measures for log information disclosure vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=228159

Trust: 0.6

sources: JVNDB: JVNDB-2023-004743 // CNNVD: CNNVD-202301-1769

EXTERNAL IDS

db:NVDid:CVE-2023-23505

Trust: 3.9

db:JVNDBid:JVNDB-2023-004743

Trust: 0.8

db:PACKETSTORMid:170699

Trust: 0.7

db:CNNVDid:CNNVD-202301-1769

Trust: 0.6

db:PACKETSTORMid:170693

Trust: 0.2

db:PACKETSTORMid:170694

Trust: 0.2

db:VULHUBid:VHN-451816

Trust: 0.1

db:VULMONid:CVE-2023-23505

Trust: 0.1

db:PACKETSTORMid:170697

Trust: 0.1

db:PACKETSTORMid:170698

Trust: 0.1

sources: VULHUB: VHN-451816 // VULMON: CVE-2023-23505 // JVNDB: JVNDB-2023-004743 // PACKETSTORM: 170697 // PACKETSTORM: 170698 // PACKETSTORM: 170699 // PACKETSTORM: 170693 // PACKETSTORM: 170694 // CNNVD: CNNVD-202301-1769 // NVD: CVE-2023-23505

REFERENCES

url:https://support.apple.com/en-us/ht213599

Trust: 2.4

url:https://support.apple.com/en-us/ht213598

Trust: 1.8

url:https://support.apple.com/en-us/ht213603

Trust: 1.8

url:https://support.apple.com/en-us/ht213604

Trust: 1.8

url:https://support.apple.com/en-us/ht213605

Trust: 1.8

url:https://support.apple.com/en-us/ht213606

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-23505

Trust: 1.3

url:https://cxsecurity.com/cveshow/cve-2023-23505/

Trust: 0.6

url:https://packetstormsecurity.com/files/170699/apple-security-advisory-2023-01-23-7.html

Trust: 0.6

url:https://www.apple.com/support/security/pgp/

Trust: 0.5

url:https://support.apple.com/en-us/ht201222.

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2023-23504

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2023-23499

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2023-23502

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2023-23518

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2023-23517

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2023-23503

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2023-23500

Trust: 0.3

url:https://support.apple.com/downloads/

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-35252

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2023-23497

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2023-23508

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2023-23512

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2023-23511

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2023-23519

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2023-23496

Trust: 0.2

url:https://www.apple.com/itunes/

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2023-23498

Trust: 0.2

url:https://nvd.nist.gov

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-23507

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-42915

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32221

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-42916

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-23493

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32915

Trust: 0.1

url:https://support.apple.com/ht213604.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-35260

Trust: 0.1

url:https://support.apple.com/ht213603.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-23513

Trust: 0.1

url:https://support.apple.com/ht213599.

Trust: 0.1

url:https://support.apple.com/kb/ht204641

Trust: 0.1

url:https://support.apple.com/ht213606.

Trust: 0.1

url:https://support.apple.com/ht213598.

Trust: 0.1

sources: VULHUB: VHN-451816 // VULMON: CVE-2023-23505 // JVNDB: JVNDB-2023-004743 // PACKETSTORM: 170697 // PACKETSTORM: 170698 // PACKETSTORM: 170699 // PACKETSTORM: 170693 // PACKETSTORM: 170694 // CNNVD: CNNVD-202301-1769 // NVD: CVE-2023-23505

CREDITS

Apple

Trust: 0.5

sources: PACKETSTORM: 170697 // PACKETSTORM: 170698 // PACKETSTORM: 170699 // PACKETSTORM: 170693 // PACKETSTORM: 170694

SOURCES

db:VULHUBid:VHN-451816
db:VULMONid:CVE-2023-23505
db:JVNDBid:JVNDB-2023-004743
db:PACKETSTORMid:170697
db:PACKETSTORMid:170698
db:PACKETSTORMid:170699
db:PACKETSTORMid:170693
db:PACKETSTORMid:170694
db:CNNVDid:CNNVD-202301-1769
db:NVDid:CVE-2023-23505

LAST UPDATE DATE

2024-08-14T12:55:35.134000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-451816date:2023-03-08T00:00:00
db:VULMONid:CVE-2023-23505date:2023-02-27T00:00:00
db:JVNDBid:JVNDB-2023-004743date:2023-11-01T06:33:00
db:CNNVDid:CNNVD-202301-1769date:2023-03-09T00:00:00
db:NVDid:CVE-2023-23505date:2023-07-27T04:15:13.447

SOURCES RELEASE DATE

db:VULHUBid:VHN-451816date:2023-02-27T00:00:00
db:VULMONid:CVE-2023-23505date:2023-02-27T00:00:00
db:JVNDBid:JVNDB-2023-004743date:2023-11-01T00:00:00
db:PACKETSTORMid:170697date:2023-01-24T16:41:07
db:PACKETSTORMid:170698date:2023-01-24T16:41:28
db:PACKETSTORMid:170699date:2023-01-24T16:41:48
db:PACKETSTORMid:170693date:2023-01-24T16:39:35
db:PACKETSTORMid:170694date:2023-01-24T16:39:55
db:CNNVDid:CNNVD-202301-1769date:2023-01-23T00:00:00
db:NVDid:CVE-2023-23505date:2023-02-27T20:15:13.750