—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA256<\/p>\n
APPLE-SA-2022-07-20-3 macOS Big Sur 11.6.8<\/p>\n
macOS Big Sur 11.6.8 addresses the following issues.
\nInformation about the security content is also available at
\nhttps:\/\/support.apple.com\/HT213344.<\/p>\n
APFS
\nAvailable for: macOS Big Sur
\nImpact: An app with root privileges may be able to execute arbitrary
\ncode with kernel privileges
\nDescription: The issue was addressed with improved memory handling.
\nCVE-2022-32832: Tommy Muir (@Muirey03)<\/p>\n
AppleMobileFileIntegrity
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to gain root privileges
\nDescription: An authorization issue was addressed with improved state
\nmanagement.
\nCVE-2022-32826: Mickey Jin (@patch1t) of Trend Micro<\/p>\n
AppleScript
\nAvailable for: macOS Big Sur
\nImpact: Processing a maliciously crafted AppleScript binary may
\nresult in unexpected termination or disclosure of process memory
\nDescription: This issue was addressed with improved checks.
\nCVE-2022-32797: Mickey Jin (@patch1t), Ye Zhang (@co0py_Cat) of Baidu
\nSecurity, Mickey Jin (@patch1t) of Trend Micro<\/p>\n
AppleScript
\nAvailable for: macOS Big Sur
\nImpact: Processing a maliciously crafted AppleScript binary may
\nresult in unexpected termination or disclosure of process memory
\nDescription: An out-of-bounds read issue was addressed with improved
\ninput validation.
\nCVE-2022-32853: Ye Zhang (@co0py_Cat) of Baidu Security
\nCVE-2022-32851: Ye Zhang (@co0py_Cat) of Baidu Security<\/p>\n
AppleScript
\nAvailable for: macOS Big Sur
\nImpact: Processing a maliciously crafted AppleScript binary may
\nresult in unexpected termination or disclosure of process memory
\nDescription: An out-of-bounds read issue was addressed with improved
\nbounds checking.
\nCVE-2022-32831: Ye Zhang (@co0py_Cat) of Baidu Security<\/p>\n
Audio
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to disclose kernel memory
\nDescription: The issue was addressed with improved memory handling.
\nCVE-2022-32825: John Aakerblom (@jaakerblom)<\/p>\n
Audio
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to execute arbitrary code with kernel
\nprivileges
\nDescription: An out-of-bounds write issue was addressed with improved
\ninput validation.
\nCVE-2022-32820: an anonymous researcher<\/p>\n
Calendar
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to access sensitive user information
\nDescription: The issue was addressed with improved handling of
\ncaches.
\nCVE-2022-32805: Csaba Fitzl (@theevilbit) of Offensive Security<\/p>\n
Calendar
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to access user-sensitive data
\nDescription: An information disclosure issue was addressed by
\nremoving the vulnerable code.
\nCVE-2022-32849: Joshua Jones<\/p>\n
CoreText
\nAvailable for: macOS Big Sur
\nImpact: A remote user may cause an unexpected app termination or
\narbitrary code execution
\nDescription: The issue was addressed with improved bounds checks.
\nCVE-2022-32839: STAR Labs (@starlabs_sg)<\/p>\n
FaceTime
\nAvailable for: macOS Big Sur
\nImpact: An app with root privileges may be able to access private
\ninformation
\nDescription: This issue was addressed by enabling hardened runtime.
\nCVE-2022-32781: Wojciech Regu\u0142a (@_r3ggi) of SecuRing<\/p>\n
File System Events
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to gain root privileges
\nDescription: A logic issue was addressed with improved state
\nmanagement.
\nCVE-2022-32819: Joshua Mason of Mandiant<\/p>\n
ICU
\nAvailable for: macOS Big Sur
\nImpact: Processing maliciously crafted web content may lead to
\narbitrary code execution
\nDescription: An out-of-bounds write issue was addressed with improved
\nbounds checking.
\nCVE-2022-32787: Dohyun Lee (@l33d0hyun) of SSD Secure Disclosure Labs
\n& DNSLab, Korea Univ.<\/p>\n
ImageIO
\nAvailable for: macOS Big Sur
\nImpact: Processing an image may lead to a denial-of-service
\nDescription: A null pointer dereference was addressed with improved
\nvalidation.
\nCVE-2022-32785: Yi\u011fit Can YILMAZ (@yilmazcanyigit)<\/p>\n
Intel Graphics Driver
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to execute arbitrary code with kernel
\nprivileges
\nDescription: The issue was addressed with improved memory handling.
\nCVE-2022-32812: Yinyi Wu (@3ndy1), ABC Research s.r.o.<\/p>\n
Intel Graphics Driver
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to execute arbitrary code with kernel
\nprivileges
\nDescription: A memory corruption vulnerability was addressed with
\nimproved locking.
\nCVE-2022-32811: ABC Research s.r.o<\/p>\n
Kernel
\nAvailable for: macOS Big Sur
\nImpact: An app with root privileges may be able to execute arbitrary
\ncode with kernel privileges
\nDescription: The issue was addressed with improved memory handling.
\nCVE-2022-32815: Xinru Chi of Pangu Lab
\nCVE-2022-32813: Xinru Chi of Pangu Lab<\/p>\n
libxml2
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to leak sensitive user information
\nDescription: A memory initialization issue was addressed with
\nimproved memory handling.
\nCVE-2022-32823<\/p>\n
PackageKit
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to modify protected parts of the file
\nsystem
\nDescription: An issue in the handling of environment variables was
\naddressed with improved validation.
\nCVE-2022-32786: Mickey Jin (@patch1t)<\/p>\n
PackageKit
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to modify protected parts of the file
\nsystem
\nDescription: This issue was addressed with improved checks.
\nCVE-2022-32800: Mickey Jin (@patch1t)<\/p>\n
PluginKit
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to read arbitrary files
\nDescription: A logic issue was addressed with improved state
\nmanagement.
\nCVE-2022-32838: Mickey Jin (@patch1t) of Trend Micro<\/p>\n
PS Normalizer
\nAvailable for: macOS Big Sur
\nImpact: Processing a maliciously crafted Postscript file may result
\nin unexpected app termination or disclosure of process memory
\nDescription: An out-of-bounds write issue was addressed with improved
\nbounds checking.
\nCVE-2022-32843: Kai Lu of Zscaler’s ThreatLabz<\/p>\n
Software Update
\nAvailable for: macOS Big Sur
\nImpact: A user in a privileged network position can track a user\u2019s
\nactivity
\nDescription: This issue was addressed by using HTTPS when sending
\ninformation over the network.
\nCVE-2022-32857: Jeffrey Paul (sneak.berlin)<\/p>\n
Spindump
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to overwrite arbitrary files
\nDescription: This issue was addressed with improved file handling.
\nCVE-2022-32807: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab<\/p>\n
Spotlight
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to gain elevated privileges
\nDescription: A validation issue in the handling of symlinks was
\naddressed with improved validation of symlinks.
\nCVE-2022-26704: Joshua Mason of Mandiant<\/p>\n
TCC
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to access sensitive user information
\nDescription: An access issue was addressed with improvements to the
\nsandbox.
\nCVE-2022-32834: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020)
\nof Tencent Security Xuanwu Lab (xlab.tencent.com)<\/p>\n
Vim
\nAvailable for: macOS Big Sur
\nImpact: Multiple issues in Vim
\nDescription: Multiple issues were addressed by updating Vim.
\nCVE-2022-0156
\nCVE-2022-0158<\/p>\n
Wi-Fi
\nAvailable for: macOS Big Sur
\nImpact: A remote user may be able to cause unexpected system
\ntermination or corrupt kernel memory
\nDescription: This issue was addressed with improved checks.
\nCVE-2022-32847: Wang Yu of Cyberserval<\/p>\n
Windows Server
\nAvailable for: macOS Big Sur
\nImpact: An app may be able to capture a user\u2019s screen
\nDescription: A logic issue was addressed with improved checks.
\nCVE-2022-32848: Jeremy Legendre of MacEnhance<\/p>\n
macOS Big Sur 11.6.8 may be obtained from the Mac App Store or
\nApple’s Software Downloads web site:
\nhttps:\/\/support.apple.com\/downloads\/
\nAll information is also posted on the Apple Security Updates
\nweb site: https:\/\/support.apple.com\/en-us\/HT201222.<\/p>\n
This message is signed with Apple’s Product Security PGP key,
\nand details are available at:
\nhttps:\/\/www.apple.com\/support\/security\/pgp\/<\/p>\n
—–BEGIN PGP SIGNATURE—–<\/p>\n
iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmLYf6sACgkQeC9qKD1p
\nrhgOJBAAtzyKOqdTnnBbwbFoG\/HoZIbCVSVOtI5VIGH1weMQ72R3X2tXB5yTlpto
\n3l\/eoMe0\/covxipiZ+CvTh9tM5ZfV3IxN4bpsbxew1R\/s81YE2K55dFp5+4zzqgh
\nYyWrx8SntngP9PywAdKa+GRZrW7R95oNp2UTwifcQvFPs40F\/OPrNQm23Xkmqsx0
\nzNNvMmqPaeCU8mgIOadO\/uv626LjnkyKdwHKM3VBxGmklNEddQDjjoWcYugH7QYj
\ne28EpKINEYfGVP\/5n4uSeP6+kXmJj9nLzdKzfBD78gyBu5NX3Ai5Wh1BbsFMoFYE
\nwcqlgEjMk3440babLb9kSRm81NX+EPgJLtjVPNRIrqs8pTh95CcDTRsotDUDl03R
\nBrP6XGyXiS+3XyhdbamJDG9pCthJdo455XaYOlmzgIfgTJMkX3kdxiMAgGvbkPVl
\n3IesUuChRvi6pZwTWXN4k5Rn9epZSV+9HaYplnFPScJpYeLzUKThz1P2KbMTd0CT
\nfiBU+fxwQqfzGRX3gyzRz0DMqiGdk0PnO9pfWND+9lQDyht7s73XnZrVOnPZHGYC
\ntiNdrEHm+4WKaEwl\/5invCZ8vPaiJ9cTH\/aSbeRkeqR8ilDQMIhm2xooSP8Sd00E
\ngTOoTOANfxrOqkFWhj0HQEq5OmCeALkE8BqiLuOVVIrN4e2LgPg=
\n=6wU+
\n—–END PGP SIGNATURE—–<\/p>\n","protected":false},"excerpt":{"rendered":"
—–BEGIN PGP SIGNED MESSAGE—– Hash: SHA256 APPLE-SA-2022-07-20-3 macOS Big Sur 11.6.8 macOS Big Sur 11.6.8 addresses the following issues. Information about the security content is also available at https:\/\/support.apple.com\/HT213344. APFS Available for: macOS Big Sur Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges Description: The issue was …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-28305","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28305","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=28305"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28305\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=28305"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=28305"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=28305"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}