Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · February 2023 — Apple Security Advisories
10 advisories 10 CVEs 4 EXPLOITED

Apple-vendor CVEs for 2023-02. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 4 are already weaponised in the wild — see the Exploited section.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2023-23529

iPadOSExploitedCISA KEV listedCRITICAL2023-02-13

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execu...

CVEs:CVE-2023-23529

Affected products

ProductStatusVendorPackageEcosystem
ipados affected apple — —
iphone_os affected apple — —
macos affected apple — —
safari affected apple — —
Upstream advisory

CVE-2023-23514

iPadOSExploitedVulnCheck KEV listedCRITICAL2023-02-13

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, macOS Big Sur 11.7.5. An app may be able to execute arbitrary co...

CVEs:CVE-2023-23514

Affected products

ProductStatusVendorPackageEcosystem
ipados affected apple — —
iphone_os affected apple — —
macos affected apple — —
Upstream advisory

CVE-2023-23524

iPadOSExploitedVulnCheck KEV listedHIGH2023-02-13

A denial-of-service issue was addressed with improved input validation. This issue is fixed in tvOS 16.3.2, iOS 16.3.1 and iPadOS 16.3.1, watchOS 9.3.1, macOS Ventura 13.2.1. Processing a maliciously crafted certificate may lead to a denial-of-service.

CVEs:CVE-2023-23524

Affected products

ProductStatusVendorPackageEcosystem
ipados affected apple — —
iphone_os affected apple — —
macos affected apple — —
tvos affected apple — —
watchos affected apple — —
Upstream advisory

CVE-2023-23522

macOSExploitedVulnCheck KEV listedMEDIUM2023-02-13

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.2.1. An app may be able to observe unprotected user data.

CVEs:CVE-2023-23522

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-42826

iPadOSPoC exploitCRITICAL2023-02-27

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1 and iPadOS 16, Safari 16.1. Processing maliciously crafted web content may lead to arbitrary code execution.

CVEs:CVE-2022-42826

Affected products

ProductStatusVendorPackageEcosystem
ipados affected apple — —
iphone_os affected apple — —
macos affected apple — —
safari affected apple — —
Upstream advisory

CVE-2020-9846

macOSPoC exploitMEDIUM2023-02-27

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1. A malicious application may be able to access local users' Apple IDs.

CVEs:CVE-2020-9846

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-32846

OtherCoalition ESS < 30%HIGH2023-02-27

A logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive data.

CVEs:CVE-2022-32846

Affected products

ProductStatusVendorPackageEcosystem
music affected apple — —
Upstream advisory

CVE-2022-32836

OtherCoalition ESS < 30%HIGH2023-02-27

This issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive data.

CVEs:CVE-2022-32836

Affected products

ProductStatusVendorPackageEcosystem
music affected apple — —
Upstream advisory

CVE-2021-46841

OtherCoalition ESS < 30%MEDIUM2023-02-27

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.5.0 for Android. An attacker in a privileged network position can track a user's activity.

CVEs:CVE-2021-46841

Affected products

ProductStatusVendorPackageEcosystem
music affected apple — —
Upstream advisory

CVE-2022-32906

OtherCoalition ESS < 30%HIGH2023-02-27

This issue was addressed with using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.9.10 for Android. A user in a privileged network position may intercept SSL/TLS connections.

CVEs:CVE-2022-32906

Affected products

ProductStatusVendorPackageEcosystem
music affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console