https://support.apple.com/en-us/HT213256

https://support.apple.com/en-us/HT213257

https://support.apple.com/en-us/HT213254

https://support.apple.com/en-us/HT213253

https://support.apple.com/kb/HT213346

20220721 APPLE-SA-2022-07-20-1 iOS 15.6 and iPadOS 15.6

The version of Apple iOS running on the mobile device is prior to 15.6. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4,     watchOS 8.6, tvOS 15.5, macOS Big Sur 11.6.6. An application may be able to execute arbitrary code with kernel     privileges. (CVE-2022-26768)

  - An out-of-bounds write issue was addressed with improved bounds checking. (CVE-2022-32787)

  - A buffer overflow was addressed with improved bounds checking. (CVE-2022-32788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.4 Monterey. It is, therefore, affected by multiple vulnerabilities :

  - Exploitation of this vulnerability may lead to memory corruption issue. (CVE-2018-25032)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser. (CVE-2021-44790)

  - Exploitation of this vulnerability may lead to arbitrary code execution. (CVE-2021-45444)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6.6 Big Sur. It is, therefore, affected by multiple vulnerabilities including the following:

  - A logic issue in AppKit that may allow a malicious application to gain root privileges. (CVE-2022-22665)

  - A logic issue in Apache HTTP Server where it fails to close an inbound connection when errors are encountered     discarding the request body, exposing the server to HTTP Request Smuggling. (CVE-2022-22720)

  - A buffer overflow issue in the mod_lua component of Apache HTTP Server. (CVE-2021-44790)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

ID	Name	Product	Family	Severity
163395	Apple iOS < 15.6 Multiple Vulnerabilities (HT213346)	Nessus	Mobile Devices	critical
161410	macOS 12.x < 12.4 (HT213257)	Nessus	MacOS X Local Security Checks	critical
161395	macOS 11.x < 11.6.6 Multiple Vulnerabilities (HT213256)	Nessus	MacOS X Local Security Checks	critical

CVE-2022-26768

high

Tenable Plugins

critical

critical

critical