https://support.apple.com/en-us/HT213443

https://support.apple.com/en-us/HT213444

https://support.apple.com/en-us/HT213445

https://support.apple.com/en-us/HT213446

https://support.apple.com/kb/HT213488

https://support.apple.com/kb/HT213486

https://support.apple.com/kb/HT213487

20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13

20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.7 Big Sur. It is, therefore, affected by multiple vulnerabilities :

  - Flaws with handling memory in the kernel. As a result, an app can be able to execute arbitrary code with     kernel privileges or disclose kernel memory. (CVE-2022-32911, CVE-2022-32864)

  - Incorrect bounds checks in the kernel. As a result, an app can execute arbitrary code with kernel     privileges. (CVE-2022-32894, CVE-2022-32917)

  - A logic issue in the Maps app. As a result an app can read sensitive location information.
    (CVE-2022-32883)

  - A flaw in the iMovie runtime. As a result a user can view sensitive information. (CVE-2022-32896)

  - A logic issue in the ATS and Contacts components. As a result an app can bypass privacy preferences.
    (CVE-2022-32854, CVE-2022-32900)

  - A logic issue in PackageKit. As a result an app can gain elevated privileges. (CVE-2022-32900)

  - A memory corruption issue in the MediaLibrary component. As a result a user can elevate privileges.
    (CVE-2022-32908)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6 Monterey. It is, therefore, affected by multiple vulnerabilities :

  - Flaws with handling memory in the kernel. As a result, an app can be able to execute arbitrary code with     kernel privileges or disclose kernel memory. (CVE-2022-32911, CVE-2022-32864)

  - Incorrect bounds checks in the kernel. As a result, an app can execute arbitrary code with kernel     privileges. (CVE-2022-32917)

  - A logic issue in the Maps app. As a result an app can read sensitive location information.
    (CVE-2022-32883)

  - A flaw in the iMovie runtime. As a result a user can view sensitive information. (CVE-2022-32896)

  - A logic issue in the ATS component. As a result an app can bypass privacy preferences. (CVE-2022-32900)

  - A logic issue in PackageKit. As a result an app can gain elevated privileges. (CVE-2022-32900)

  - A memory corruption issue in the MediaLibrary component. As a result a user can elevate privileges.
    (CVE-2022-32908)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 16. It is, therefore, affected by multiple vulnerabilities:

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32886)

  - An app may be able to disclose kernel memory (CVE-2022-32864)

  - An app may be able to execute arbitrary code with kernel privilege (CVE-2022-32911)    
  - An application may be able to execute arbitrary code with kernel privileges (CVE-2022-32917)

  - A user may be able to elevate privileges (CVE-2022-32908)

  - Visiting a malicious website may lead to address bar spoofing (CVE-2022-32795)

  - An app may be able to bypass Privacy preferences (CVE-2022-32854) 

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32912)

  - A website may be able to track users through Safari web extensions (CVE-2022-32868)

  - A person with physical access to an iOS device may be able to access photos from the lock screen (CVE-2022-32872)

  - An app may be able to read sensitive location information (CVE-2022-32883)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 15.7. It is, therefore, affected by multiple vulnerabilities:

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32886)

  - An app may be able to disclose kernel memory (CVE-2022-32864)

  - An app may be able to execute arbitrary code with kernel privilege (CVE-2022-32911)    
  - An application may be able to execute arbitrary code with kernel privileges (CVE-2022-32917)

  - A user may be able to elevate privileges (CVE-2022-32908)

  - Visiting a malicious website may lead to address bar spoofing (CVE-2022-32795)

  - An app may be able to bypass Privacy preferences (CVE-2022-32854) 

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32912)

  - A website may be able to track users through Safari web extensions (CVE-2022-32868)

  - A person with physical access to an iOS device may be able to access photos from the lock screen (CVE-2022-32872)

  - An app may be able to read sensitive location information (CVE-2022-32883)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
165108	macOS 11.x < 11.7 (HT213443)	Nessus	MacOS X Local Security Checks	high
165106	macOS 12.x < 12.6 (HT213444)	Nessus	MacOS X Local Security Checks	high
165105	Apple iOS < 16 Multiple Vulnerabilities (HT213446)	Nessus	Mobile Devices	high
164970	Apple iOS < 15.7 Multiple Vulnerabilities (HT213445)	Nessus	Mobile Devices	high

CVE-2022-32908

high

Tenable Plugins

high

high

high

high