A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

The version of Apple iOS running on the mobile device is prior to 16.7. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 17.0.1. It is, therefore, affected by multiple vulnerabilities, as follows:

  - A privilege elevation vulnerability in the kernel due to insufficient checks. (CVE-2023-41992)

  - A signature bypass vulnerability due to insufficient certificate validation. (CVE-2023-41991)

  - An arbitrary code execution vulnerability in Webkit due to insufficient checks. (CVE-2023-41993)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version.

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.6. It is, therefore, affected by multiple vulnerabilities:

  - A malicious app may be able to bypass signature validation. (CVE-2023-41991)  

  - A local attacker may be able to elevate their privileges (CVE-2023-41992)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

ID	Name	Product	Family	Severity
181843	Apple iOS < 16.7 Multiple Vulnerabilities (HT213927)	Nessus	Mobile Devices	high
181842	Apple iOS < 17.0.1 Multiple Vulnerabilities (HT213926)	Nessus	Mobile Devices	high
181763	macOS 13.x < 13.6 Multiple Vulnerabilities (HT213931)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2023-41991

medium

Tenable Plugins

high

high

high