Advisories
iPadOSExploitedCISA KEV listedCRITICAL2022-12-13
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execut...
CVEs:CVE-2022-42856
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
iPadOSExploitedCISA KEV listedHIGH2022-12-13
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware...
CVEs:CVE-2022-48618
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedCRITICAL2022-12-13
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to exe...
CVEs:CVE-2022-46689
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedCRITICAL2022-12-13
An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, watchOS 9.2. A remote user may be able to cause unexpec...
CVEs:CVE-2022-42837
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedCRITICAL2022-12-13
A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content m...
CVEs:CVE-2022-46691
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedMEDIUM2022-12-13
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Visiting a website tha...
CVEs:CVE-2022-46695
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedCRITICAL2022-12-13
A race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to e...
CVEs:CVE-2022-42864
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedCRITICAL2022-12-13
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2022-46690
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedHIGH2022-12-13
A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to use arbitrary entitlements.
CVEs:CVE-2022-42855
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedCRITICAL2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with ker...
CVEs:CVE-2022-42840
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedMEDIUM2022-12-13
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to read sensitive location information
CVEs:CVE-2022-46718
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedCRITICAL2022-12-13
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2, watchOS 9.2. Parsing a maliciously crafted video file may lead to kernel code execution.
CVEs:CVE-2022-46694
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedMEDIUM2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2. Parsing a maliciously crafted video file may lead to unexpected system termination.
CVEs:CVE-2022-42846
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedCRITICAL2022-12-13
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2022-42848
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedHIGH2022-12-13
This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2. An app may be able to break out of its sandbox.
CVEs:CVE-2022-42861
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSExploitedVulnCheck KEV listedMEDIUM2022-12-13
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. An app may be able to read sensitive location information
CVEs:CVE-2022-46703
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSWeaponized exploitCRITICAL2022-12-13
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execut...
CVEs:CVE-2022-42867
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSActive exploitation (sightings)HIGH2022-12-13
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality did not match system settings
CVEs:CVE-2022-46716
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSActive exploitation (sightings)LOW2022-12-13
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2. A user with physical access to a locked Apple Watch may be able to view user photos via accessibility features
CVEs:CVE-2022-46717
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
macOSActive exploitation (sightings)CRITICAL2022-12-13
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges
CVEs:CVE-2022-42858
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
iPadOSActive exploitation (sightings)MEDIUM2022-12-13
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud links even if Location metadata is disabled via the Share Sheet.
CVEs:CVE-2022-46710
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
macOSActive exploitation (sightings)MEDIUM2022-12-13
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to modify protected parts of the file system.
CVEs:CVE-2022-46704
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
iPadOSCoalition ESS > 63%CRITICAL2022-12-13
A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content m...
CVEs:CVE-2022-46700
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSCoalition ESS > 63%MEDIUM2022-12-13
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, Safari 16.2. Visiting a malicious website may lead to address bar spoofing.
CVEs:CVE-2022-46705
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSCoalition ESS > 63%MEDIUM2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the ...
CVEs:CVE-2022-42852
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSCoalition ESS > 63%MEDIUM2022-12-13
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted ...
CVEs:CVE-2022-46692
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSPoC exploitMEDIUM2022-12-13
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatekeeper checks.
CVEs:CVE-2022-42821
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
OtherPoC exploitCRITICAL2022-12-20
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific prot...
CVEs:CVE-2022-43552
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
iPadOSPoC exploitCRITICAL2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. A remote user may be able to cause kernel code execution.
CVEs:CVE-2022-42842
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSPoC exploitCRITICAL2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app with root privileges may be able to execute arbitrar...
CVEs:CVE-2022-42845
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSPoC exploitCRITICAL2022-12-13
A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code exec...
CVEs:CVE-2022-46696
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSPoC exploitCRITICAL2022-12-13
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code exec...
CVEs:CVE-2022-46699
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSPoC exploitCRITICAL2022-12-13
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code exec...
CVEs:CVE-2022-42863
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSPoC exploitMEDIUM2022-12-13
A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user ...
CVEs:CVE-2022-46698
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSPoC exploitMEDIUM2022-12-13
The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication.
CVEs:CVE-2022-32943
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSPoC exploitHIGH2022-12-13
This issue was addressed with improved data protection. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. A user may be able to view sensitive user information.
CVEs:CVE-2022-42843
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSPoC exploitCRITICAL2022-12-13
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2022-46697
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
iPadOSPoC exploitCRITICAL2022-12-13
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing a maliciously crafted file may lead to arbitrary...
CVEs:CVE-2022-46693
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSPoC exploitCRITICAL2022-12-13
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2022-42847
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
macOSPoC exploitCRITICAL2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. An app may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2022-32942
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
macOSPoC exploitCRITICAL2022-12-13
A type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. Processing a maliciously crafted package may lead to arbitrary code execution.
CVEs:CVE-2022-42841
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
macOSPoC exploitCRITICAL2022-12-15
An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record audio with paired AirPods.
CVEs:CVE-2022-32945
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSPoC exploitMEDIUM2022-12-13
Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2. An app may be able to bypass Privacy preferences.
CVEs:CVE-2022-42859
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSPoC exploitCRITICAL2022-12-13
The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious NFS server may lead to arbitrary code execution with kernel privileges.
CVEs:CVE-2022-46701
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
iPadOSPoC exploitMEDIUM2022-12-13
The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to read sensitive location information.
CVEs:CVE-2022-42866
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSPoC exploitMEDIUM2022-12-13
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to bypass Privacy preferences.
CVEs:CVE-2022-42862
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSPoC exploitMEDIUM2022-12-13
This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to bypass Privacy preferences.
CVEs:CVE-2022-42865
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSPoC exploitMEDIUM2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1. An app may be able to disclose kernel memory.
CVEs:CVE-2022-42854
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
macOSPoC exploitMEDIUM2022-12-13
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may be able to modify protected parts of the file system.
CVEs:CVE-2022-42853
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| macos |
affected |
apple |
— |
— |
iPadOSPoC exploitCRITICAL2022-12-13
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to break out of its sandbox
CVEs:CVE-2022-46720
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| macos |
affected |
apple |
— |
— |
iPadOSCoalition ESS < 30%CRITICAL2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2022-42850
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
iPadOSCoalition ESS < 30%HIGH2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to break out of its sandbox.
CVEs:CVE-2022-42844
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
iPadOSCoalition ESS < 30%MEDIUM2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2. Parsing a maliciously crafted TIFF file may lead to disclosure of user information.
CVEs:CVE-2022-42851
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
iPadOSCoalition ESS < 30%HIGH2022-12-13
An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2, watchOS 9.2. A user may be able to elevate privileges.
CVEs:CVE-2022-42849
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iPadOSCoalition ESS < 30%MEDIUM2022-12-13
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to disclose kernel memory.
CVEs:CVE-2022-46702
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| ipados |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
