![]() Attackers may gain writable access to files during the install of PKG when extraction of the package and copying files to several directories, enabling a local escalation of privilege.Ī use after free issue was addressed with improved memory management. During the install of the PKG, a step in the process involves extracting the package and copying files to several directories. Attackers may exploit incorrect file permissions to give them ROOT command execution privileges on the host. Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. An app may be able to bypass Privacy preferences This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 16.4 and iPadOS 16.4. A user in a privileged network position may be able to cause a denial-of-serviceĪ logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to execute arbitrary code with kernel privilegesĪ denial-of-service issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, watchOS 9.4, iOS 16.4 and iPadOS 16.4. The issue was addressed with improved memory handling. A user in a privileged network position may be able to spoof a VPN server that is configured with EAP-only authentication on a device This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16.4. The issue was addressed with improved authentication. An app may be able to view sensitive information The issue was addressed with improved checks. An app may be able to access user-sensitive data An app may be able to read sensitive location informationĪ privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to disclose kernel memoryĪ permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Big Sur 11.7.5. A remote user may be able to cause unexpected app termination or arbitrary code executionĪ validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, Safari 16.4, iOS 16.4 and iPadOS 16.4. This issue was addressed with improved state management. Apple is aware of a report that this issue may have been actively exploited. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.Ī use after free issue was addressed with improved memory management. An app may be able to execute arbitrary code with kernel privileges. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.Īn out-of-bounds write issue was addressed with improved input validation. Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions, 18.12.402, 18.12.407, and 18.12.416 of the 3CX DesktopApp Electron macOS application. An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.ģCX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023.
0 Comments
Leave a Reply. |